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To  promote  the  adoption  and  meaningful  use  of  health  information  technology, 

and  for  other  purposes. 


IN  THE  HOUSE  OF  REPRESENTATIVES 

September  15,  2008 

Mr.  Stark  (for  himself,  Ms.  Schwartz,  Mr.  McDermott,  Mr.  McNulty, 
Mr.  Le\tn,  Mr.  EMANUEL,  Mr.  Neal  of  Massachusetts,  Mr.  Pascrbll, 
and  Mr.  LEWIS  of  Georgia)  introduced  the  following  bill;  which  was  re- 
ferred to  the  Committee  on  Energy  and  Commerce,  and  in  addition  to 
the  Comimittees  on  Ways  and  Means  and  Science  and  Technology,  for  a 
period  to  be  subsequently  determined  by  the  Speaker,  in  each  case  for 
consideration  of  such  provisions  as  fall  within  the  jurisdiction  of  the  com- 
mittee concerned 


A  BILL 

To  promote  the  adoption  and  meaningfal  use  of  health 
information  technology,  and  for  other  purposes. 

1  Be  it  enacted  hy  the  Senate  and  House  of  Representa- 

2  tives  of  the  United  States  of  America  in  Congress  assembled, 

3  SECTION  1.  SHORT  TITLE;  TABLE  OF  CONTENTS. 

4  (a)  Short  Title. — This  Act  may  be  cited  as  the 

5  ''Health-e  Information  Technology  Act  of  2008". 

6  (b)  Table  op  Contents. — The  table  of  contents  for 

7  this  Act  is  as  follows: 


See.  1.  Short  title;  table  of  contents. 
TITLE  I— PROMOTION  OF  HEALTH  INFORMATION  TECHNOLOGY 
Subtitle  A — Improving  Health  Care  Quality,  Safety,  and  Efficiency 

Sec.  101.  ONCHIT;  standards  development  and  adoption;  health  information 
technology  resource  center. 

"TITLE  XXX— HEALTH  INFORMATION  TECHNOLOGY  AND 

QUALITY 

"Sec.  3000.  Definitions. 

"Subtitle  A — Promotion  of  Health  Information  Technology 

"Sec.  3001.  Office  of  the  National  Coordinator  for  Health  Information 

Technology. 
"See.  3002.  HIT  Advisory  Committee. 

"Sec.  3003.  Process  for  adoption  of  recommended  standards  and  guidance. 
"Sec.  3004.  Application  and  use  of  adopted  standards  by  Federal  agencies. 
"Sec.  3005.  Voluntary  application  and  use  of  adopted  standards  by  private 
entities. 

"Sec.  3006.  Health  Information  Technology  Resource  Center. 
Sec.  102.  Transitions. 

Subtitle  B — ^Application  and  Use  of  Adopted  Health  Information  Technology 

Standards;  Reports 

See.  111.  Coordination  of  Federal  activities  with  adopted  standards. 
Sec.  112.  Apphcation  to  private  entities. 
Sec.  113.  Annual  reports. 

TITLE  II— TESTING  OF  HEALTH  INFORMATION  TECHNOLOGY 
Sec.  201.  National  Institute  for  Standards  and  Technology  testing. 

TITLE  HI- INCENTIVES  FOR  ADOPTION  OF  HEALTH 
INFORMATION  TECHNOLOGY 

Subtitle  A — Medicare  Program 

Sec.  301.  Incentives  for  eligible  professionals. 
See.  302.  Incentives  for  hospitals. 

Sec.  303.  Incentives  for  certain  Medicare  Advantage  plans. 

Subtitle  B — Other  Incentives  for  the  Implementation  and  Use  of  Health 
Information  Technologj^ 

Sec.  311.  Grant,  loan,  and  demonstration  programs. 

"Subtitle  B — Incentives  for  the  Use  of  Health  Information  Technology 

"See.  3011.  Grants  and  loans  to  facilitate  the  widespread  adoption  of 
qualified  health  information  technology. 

"Sec.  3012.  Demonstration  program  to  integrate  information  technology 
into  clinical  education. 

TITLE  rV— PRIVACY  AND  SECURITY  PROVISIONS 
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Sec.  400.  Definitions. 

Subtitle  A — Improved  Privacy  Provisions  and  Security  Provisions 

See.  401.  Application  of  security  provisions  and  penalties  to  business  associates 
of  covered  entities;  annual  guidance  on  privacy  and  security 
provisions. 

Sec.  402.  Notification  in  the  case  of  breach. 

Sec.  403.  Education  on  health  information  privacy  and  report  on  compliance. 

Sec.  404.  Application  of  penalties  to  business  associates  of  covered  entities  for 
violations  of  privacy  contract  requirements. 

Sec.  405.  Restrictions  on  certain  uses  and  disclosures  and  sales  of  health  infor- 
mation; accounting  of  certain  protected  health  information  dis- 
closures; access  to  certain  information  in  electronic  format. 

Sec.  406.  Limitations  on  certain  activities  as  part  of  health  care  opei'ations. 

Sec.  407.  Study  and  report  on  application  of  privacy  and  security  requirements 
to  non-HIPAA  covered  entities. 

Sec.  408.  Temporary  breach  notification  requirement  for  vendors  of  personal 
health  records  and  other  non-HIPAA  covered  entities. 

Sec.  409.  Business  associate  contracts  required  for  certain  entities;  other  provi- 
sions related  to  business  associate  contracts. 

Sec.  410.  Guidance  on  implementation  specification  to  de-identify  protected 
health  information. 

Sec.  411.  GAO  report  on  treatment,  payment,  and  health  care  operations  uses 
and  disclosures. 

Sec.  412.  Clarification  of  apphcation  of  wrongful  disclosures  criminal  penalties. 

Sec.  413.  Improved  enforcement. 

Sec.  414.  Audits. 

Sec.  415.  Technical,  amendment. 

Subtitle  B— Chief  Privacy  Officer  of  ONCHIT;  Standards  and  Guidance 
Recommendations  Related  to  Privacy  and  Security 

Sec.  421.  Chief  Privacy  Officer  of  the  Office  of  the  National  Coordinator  . 
Sec.  422.  Additional  standards  and  guidance  recommendations  related  to  pri- 
vacy and  security. 

Subtitle  C — Relationship  to  Other  Laws;  Regulatory  References;  Effective 

Date 

Sec.  431.  Relationship  to  other  laws. 
Sec.  432.  Regulatory  references. 
Sec.  433.  Effective  date. 
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1  TITLE  I— PROMOTION  OF 

2  HEALTH  INFORMATION  TECH- 

3  NOLOGY 

4  Subtitle  A — Improving  Health  Care 

5  Quality,  Safety,  and  Efficiency 

6  SEC.  101.  ONCHIT;  STANDARDS  DEVELOPMENT  AND  ADOP- 

7  TION;  HEALTH  INFORMATION  TECHNOLOGY 

8  RESOURCE  CENTER. 

9  (a)  In  General. — The  Public  Health  Service  Act 

10  (42  U.S.C.  201  et  seq.)  is  amended  by  adding  at  the  end 

1 1  the  following: 

12  "TITLE  XXX— HEALTH  INFORMA- 

13  TION      TECHNOLOGY  AND 

14  QUALITY 

15  "SEC.  3000.  DEFINITIONS. 


16  "In  this  title: 

17  "(1)  Electronic  health  record. — The  term 

18  'electronic  health  record'  means  an  electronic  record 

19  of  health-related  information  on  an  individual  that  is 

20  created,   managed,   and   consulted  by  authorized 

21  health  care  clinicians  and  staff  of  one  or  more  orga- 

22  nizations,  that  conforms  to  standards  adopted  under 

23  section  3003(a),  and  is  made  accessible  electronically 

24  to  other  health  care  organizations  and  other  author- 

25  ized  users. 
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1  "(2)   Health   care   provider. — The  term 

2  'health  care  provider^  means  a  hospital,  skilled  nurs- 

3  ing  facility,  nursing  facility,  home  health  entity, 

4  health  care  clinic.  Federally  quahfied  health  center, 

5  group  practice  (as  defined  in  section  1877(h)(4)  of 

6  the  Social  Security  Act),  a  pharmacist,  a  pharmacy, 

7  a  laboratory,  a  physician  (as  defined  in  section 

8  1861(r))  of  the  Social  Security  Act),  a  practitioner 

9  (as  described  in  section  1 842(b) (1 8) (C)  of  the  Social 

10  Security  Act),  a  provider  operated  by,  or  under  con- 

1 1  tract  with,  the  Indian  Health  Service  or  by  an  In- 

12  dian  tribe  (as  defined  in  the  Indian  Self-Determina- 

13  tion  and  Education  Assistance  Act),  tribal  organiza- 

14  tion,  or  urban  Indian  organization  (as  defined  in 

15  section  4  of  the  Indian  Health  Care  Improvement 

16  Act),  a  rural  health  clinic,  and  any  other  category  of 

17  facility  or  clinician  determined  appropriate  by  the 

18  Secretary. 

19  "(3)  HeaIjTH  information. — The  term  'health 

20  information'  has  the  meaning  given  such  term  in 

21  section  1171(4)  of  the  Social  Security  Act. 

22  "(4)  HeaijTH  inf^ormation  technology. — 

23  The  term  'health  information  technology'  means 

24  hardware,  software,  integrated  technologies  and  re- 

25  lated  licenses,  intellectual  property,  upgrades,  and 
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1  packaged  solutions  sold  as  services  that  are  specifi- 

2  cally  designed  for  use  by  health  care  entities  for  the 

3  electronic  creation,  maintenance,   or  exchange  of 

4  health  information. 

5  "(5)  Health  plan. — The  term  'health  plan' 

6  has  the  meaning  given  such  term  in  section  1171(5) 

7  of  the  Social  Security  Act. 

8  "(6)  HIT  ADVISORY  COMMITTEE. — The  term 

9  'HIT  Advisory  Committee'  means  such  Committee 

10  established  under  section  3002(a). 

11  "(7)  Individually  identifiable  health  in- 

12  FORMATION. — The    term    'individually  identifiable 

13  health  information'  has  the  meaning  given  such  term 

14  in  section  1171(6)  of  the  Social  Security  Act. 

15  "(8)  Laboratory. — The  term  'laboratory'  has 

16  the  meaning  given  such  term  in  section  353(a). 

17  "(9)  National  coordinator. — The  term  'Na- 

18  tional  Coordinator'  means  the  head  of  the  Office  of 

19  the  National  Coordinator  for  Health  Information 

20  Technology  established  under  section  3001(a). 

21  "(10)   Pharmacist. — The  term  'pharmacist' 

22  has  the  meaning  given  such  term  in  section  804(2) 

23  of  the  Federal  Food,  Drug,  and  Cosmetic  Act. 

24  "(11)  State. — The  term  'State'  means  each  of 

25  the  several  States,  the  District  of  Columbia,  Puerto 
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1  Rico,  the  Virgin  Islands,  Guam,  American  Samoa, 

2  and  the  Northern  Mariana  Islands. 

3  "Subtitle  A — Promotion  of  Health 

4  Information  Technology 

5  "SEC.  3001.  OFFICE  OF  THE  NATIONAL  COORDINATOR  FOR 

6  HEALTH  INFORMATION  TECHNOLOGY. 

7  "(a)  Establishment. — There  is  estabhshed  within 

8  the  Department  of  Health  and  Human  Services  an  Office 

9  of  the  National  Coordinator  for  Health  Information  Tech- 

10  nology  (referred  to  in  this  section  as  the  'Office').  The  Of- 

1 1  fice  shall  be  headed  by  a  National  Coordinator  who  shall 

12  be  appointed  by  the  Secretary  and  shall  report  directly  to 

13  the  Secretary. 

14  "(b)  Purpose. — The  National  Coordinator  shall  per- 

15  form  the  duties  under  subsection  (c)  in  a  manner  con- 

16  sistent  with  the  development  of  a  nationwide  health  infor- 

17  mation  technology  infrastructure  that  allows  for  the  elec- 

1 8  tronic  use  and  exchange  of  information  and  that — 

19  "(1)  ensures  that  each  patient's  health  informa- 

20  tion  is  secure  and  protected,  in  accordance  with  ap- 

21  plicable  law; 

22  "(2)  improves  health  care  quality,  reduces  med- 

23  ical  errors,  and  advances  the  delivery  of  patient-cen- 

24  tered  medical  care; 
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1  "(3)  reduces  health  care  costs  resultmg  from 

2  inefficiency,  medical  errors,  inappropriate  care,  du- 

3  plicative  care,  and  incomplete  information; 

4  "(4)  ensures  that  appropriate  information  to 

5  help  guide  medical  decisions  is  available  at  the  time 

6  and  place  of  care; 

7  "(5)  ensures  the  inclusion  of  meaningful  public 

8  input  in  such  development  of  such  infrastructure; 

9  "(6)  improves  the  coordination  of  care  and  in- 

10  formation  among  hospitals,  laboratories,  physician 

11  offices,  and  other  entities  through  an  effective  infra- 

12  structure  for  the  secure  and  authorized  exchange  of 

13  health  care  information; 

14  "(7)  improves  public  health  reporting  and  facili- 

15  tates  the  early  identification  and  rapid  response  to 

16  public  health  threats  and  emergencies,  including  bio- 

17  terror  events  and  infectious  disease  outbreaks; 

18  "(8)  facilitates  health  and  clinical  research  and 

19  health  care  quality; 

20  "(9)  promotes  prevention  of  chronic  diseases; 

21  "(10)  promotes  a  more  effective  marketplace, 

22  greater  competition,  greater  systems  analysis,  in- 

23  creased  consumer  choice,  and  improved  outcomes  in 

24  health  care  services;  and 
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1  "(11)  improves  efforts  to  reduce  health  dispari- 

2  ties. 

3  "(c)  Duties  of  the  National  Coordinator. — 

4  "(1)    HIT   POLICY   COORDINATION. — The  Na- 

5  tional  Coordinator  shall  coordinate  health  informa- 

6  tion  technology  policy  and  programs  within  the  De- 

7  partment  and  with  those  of  other  relevant  executive 

8  branch  ag'encies  with  a  goal  of  avoiding  duplication 

9  of  efforts  and  of  helping  to  ensure  that  each  agency 

10  undertakes  health  information  technology  activities 

11  primarily  within  the  areas  of  its  greatest  expertise 

12  and  technical  capability. 

13  "(2)  Standards,  guidance. — 

14  "(A)  Development  and  recommenda- 

15  TiONS  OP  standards  and  guidance. — 

16  "(i)  In  general. — 

17  "(I)      Initial  implementa- 

18  TION. — The     National  Coordinator 

19  shall,  in  consultation  with  the  HIT 

20  Advisory    Committee    under  section 

21  3002  and  consistent  with  the  imple- 

22  mentation  of  the  strategic  plan  under 

23  paragraph    (6),    develop    and  rec- 

24  ommend  to  the  Secretary  standards 

25  and  ^idance  (which  may  include  best 
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1  practices),  as  applicable,  for  each  of 

2  the  categories  described  in  clauses 

3  (iii),  (iv),  and  (v).  In  accordance  with 

4  the  previous  sentence,  the  National 

5  Coordinator  shall  ensure  that  an  ini- 

6  tial  set  of  appropriate  standards  is  de- 

7  veloped  and  recommended  to  the  Sec- 

8  retary  under  this  subclause  by  such 

9  time  as  to  enable  the  Secretary  to 

10  adopt  such  an  initial  set  in  accordance 

11  with  section  3003(b). 

12  "(II)  Biennial  updating. — Bi- 

13  ennially  thereafter  the  National  Coor- 

14  dinator,  in  consultation  with  the  HIT 

15  Advisory    Committee,    shall  update 

16  such  recommendations  and  make  new 

17  recommendations  as  appropriate,  in- 

18  eluding  in  response  to  a  notification 

19  sent  under  section  3003(a)(2). 

20  "(ii)    Coordination   among  cat- 

21  EGORIES. — The  National  Coordinator  shall 

22  coordinate  the  development,  recommenda- 

23  tions,  and  updating  among  the  categories 

24  so  described  to  take  into  account  the  inter- 
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1  dependence   of  standards   and  guidance 

2  among  such  categories. 

3  "(iii)  Technical  interoperability 

4  CATEGORY. — 

5  "(I)  In  general. — The  category 

6  described  in  this  clause  is  the  category 

7  for  technical  interoperability  to  pro- 

8  vide  for  the  electronic  exchange  and 

9  use  of  health  information. 

10  "(II)    Application    to  dif- 

11  ferent    levels    of  interoper- 

12  ABILITY. — In  developing  recommenda- 

13  tions    respecting   the    category  de- 

14  scribed  in  this  clause,  the  National 

15  Coordinator  shall  initially  use  the  dif- 

16  ferent  levels  of  interoperability  (as  de- 

17  scribed  on  pages  6  though  8  of  GAO 

18  report     08-954     titled  'Electronic 

19  Health  Records:  DOD  and  VA  Have 

20  Increased  Sharing  of  Health  Informa- 

21  tion,  but  More  Work  Remains'  and 

22  provide  for  the  development  and  rec- 

23  ommendations  of  different  standards 

24  and  guidance  for  each  of  such  dif- 

25  ferent  levels. 
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1  "(iv)  Privacy  and  security  cat- 

2  EGORY. — The  category  described  in  this 

3  clause  is  the  category  for  privacy  and  secu- 

4  rity  to  ensure  the  secure  exchange  of  pro- 

5  tected  health  information,  in  accordance 

6  with  title  IV  of  the  Health-e  Information 

7  Technology  Act  of  2008   including  the 

8  amendments  made  by  such  title. 

9  "(v)  Clinical  and  quality  cat- 

10  EGORY. — 

11  "(I)  In  general. — The  category 

12  described  in  this  clause  is  the  category 

13  for  clinical  and  quality  functionalities 

14  of  health  information  technology  and 

15  strategies  to  enhance  the  use  of  such 

16  technology  including  for  the  following 

17  purposes: 

18  "(aa)  To  improve  the  quality 

19  of  health  care,  such  as  through 

20  the  reduction  of  medical  errors, 

21  using  electronic  provider  order 

22  entry  and  clinical  decision  sup- 

23  port  systems. 

24  "(bb)  To  facilitate  patient- 

25  centered  care,  such  as  through 
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1  improved   patient-provider  eom- 

2  munication  through  secure  elee- 

3  tronic  messaging,  and  improved 

4  patient  support. 

5  ''(cc)  To  reduce  health  dis- 

6  parities. 

7  "(dd)  To  improve  population 

8  health,  such  as  through  the  use 

9  of  registries  and  automated  qual- 

10  ity   reporting   and  performance 

1 1  measures. 

12  "(ee)  To  improve  the  con- 

13  tinuity  of  care  among  health  care 

14  settings. 

15  "(II)  Requirements. — In  devel- 

16  oping  recommendations  respecting  the 

17  category  described  in  this  clause,  the 

18  National  Coordinator  shall  ensure  the 

19  following: 

20  "(aa)    Information    is  col- 

21  lected  and  transmitted  in  a  man- 

22  ner  that  is  reliable,  accurate,  and 

23  unambiguous  and  based  on  a  uni- 

24  form  provider  data  set,  including 
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1  a  set  of  comprehensive  data  ele- 

2  ments. 

3  "(bb)   Information  is  com- 

4  municated  in  a  manner  to  pro- 

5  mote  coordination  of  health  care, 

6  applying   appropriate    data  fil- 

7  tering  for  the  situation. 

8  "(cc)  Practices  optimize  for 

9  continuous     improvement,  ad- 

10  vancement  of  research  and  edu- 

11  cation,   and  population  disease 

12  management. 

13  .  "(dd)     Sensitive  protected 

14  health  information  may  be  seg- 

15  mented,  with  the  goal  of  mini- 

16  mizing  the  reluctance  of  patients 

17  to  seek  care  (or  disclose  informa- 

18  tion  about  a  condition)  because 

19  of  privacy  concerns  involving  sen- 

20  sitive  protected  health  informa- 

21  tion,   while   maximizing  patient 

22  safety  and  clinical  utility  of  the 

23  information. 

24  "(B)  Incorporation  op  current  cchit 

25  certification  criteria. — In  developing  and 
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1  recommending  standards  and  gnidance  under 

2  subparagraph  (A),  the  National  Coordinator 

3  shall,  to  the  maximum  extent  appropriate,  in- 

4  corporate     the     ambulatory     and  inpatient 

5  functionality   certification   criteria   that  have 

6  been  adopted  by  the  Certification  Commission 

7  for  Health  Information  Technology  as  of  the 

8  date  of  the  enactment  of  this  title.  Nothing  in 

9  this  paragraph  shall  be  construed  as  preventing 

10  the  National  Coordinator  from  incorporating 

11  into  such  recommendations  such  certification 

12  criteria  as  such  Commission  is  in  the  process  of 

13  adopting  as  of  such  date. 

14  "(C)  Provider  and  setting  specific. — 

15  Recommendations  made  under  subparagraph 

16  (A)  may  be  established  in  a  provider-specific 

17  and  setting- specific  manner  and  in  a  manner 

18  such  that  they  apply  to  a  broad  variety  of  pro- 

19  viders,    including   physicians,    hospitals,  and 

20  other  health  care  providers  and  to  a  broad  vari- 

21  ety  of  settings,  including  for  health  information 

22  technology  systems  that  are  hospital-based  and 

23  for  such  systems  that  are  office-based. 

24  "(D)  Pilot  testing  of  standards  and 

25  implementation  specifications. — In  the  de- 
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1  velopment  of  standards  under  this  paragraph, 

2  the  National  Coordinator,  as  appropriate,  shall 

3  provide  for  the  testing  of  such  standards  in  col- 

4  laboration   with   the    National    Institute  for 

5  Standards  and  Technology  under  section  201  of 

6  the  Health-e  Information  Technology  Act  of 

7  2008. 

8  "(E)  Consistency  with  privacy  and 

9  SECURITY  REQUIREMENTS. — The  Standards  rec- 

10  ommended  under  this  paragraph  shall  be  con- 

11  sistent  with  applicable  privacy  and  security 

12  standards  and  requirements  adopted  pursuant 

13  to  section  1173  of  the  Social  Security  Act,  to 

14  title  IV  of  the  Health-e  Information  Technology 

15  Act  of  2008,  or  otherwise. 

16  "(F)  Public  input. — The  National  Coor- 

17  dinator  shall  conduct  open  public  meetings  and 

18  develop  a  process  to  allow  for  public  comment 

19  on  the  recommendations  made  under  this  para- 

20  graph.  Under  such  process  comments  shall  be 

21  submitted  in  a  timely  manner  after  the  date  of 

22  publication  of  a  recommendation  under  this 

23  paragraph. 

24  "(G)  Publication. — The  Secretary  shall 

25  provide  for  publication  in  the  Federal  Register 
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1  and  the  posting  on  the  Internet  website  of  the 

2  Office  of  the  National  Coordinator  for  Health 

3  Information  Technology  of  all  recommendations 

4  made  by  the  National  Coordinator  under  this 

5  paragraph. 

6  "(3)  Certification. — The  National  Coordi- 

7  nator,  in  consultation  with  the  Director  of  the  Na- 

8  tional  Institute  of  Standards  and  Technology  and 

9  other  relevant  Federal  agencies,  shall  develop  a  pro- 

10  gram  (either  directly  or  by  contract)  for  the  vol- 

11  untary  certification  (and  periodic  recertification)  of 

12  health  information  technology  systems  (and  compo- 

13  nents  of  such  systems)  as  being  in  compliance  with 

14  all  applicable  standards  (for  each  category  described 

15  in  paragraph  (2) (A))  that  are  adopted  under  this 

16  subtitle.  Such  program  shall  include  testing  of  the 

17  technology  in  accordance  with  section  201(b)  of  the 

18  Health-e  Information  Technology  Act  of  2008. 

19  "(4)  FederaIj  open  source  health  it  sys- 

20  TEM. — 

21  "(A)  In  general. — The  National  Coordi- 

22  nator  shall  provide  for  coordinating  the  develop- 

23  ment,  routine  updating,  and  provision  of  an 

24  open  source  health  information  technology  sys- 

25  tem  that  is  either  new  or  based  on  an  open 
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1  source  health  information  technology  system, 

2  such  as  VistA,  that  is  in  existence  as  of  the 

3  date  of  the  enactment  of  this  title  and  that  is 

4  in  compliance  with  all  applicable  standards  (for 

5  each  category  described  in  paragraph  (2) (A)) 

6  that  are  adopted  under  this  subtitle.  The  Na- 

7  tional  Coordinator  shall  make  such  system  pub- 

8  licly  available  for  use,  after  appropriate  pilot 

9  testing,  as  soon  as  practicable  but  not  later 

10  than  9  months  after  the  date  of  the  adoption  by 

11  the  Secretary  of  the  initial  set  of  standards  and 

12  guidance  under  section  3003(c). 

13  "(B)  Consortium. — In  order  to  carry  out 

14  subparagraph  (A),  the  National  Coordinator 

15  shall  establish,  not  later  than  6  months  after 

16  the  date  of  the  enactment  of  this  section,  a  con- 

17  sortium  comprised  of  individuals  with  technical, 

18  clinical,  and  legal  expertise  open  source  health 

19  information  technology.  The  Secretary,  through 

20  agencies  with  the  Department,  shall  provide  as- 

21  sistance  to  the  consortium  in  conducting  its  ac- 

22  tivities  under  this  paragraph. 

23  "(C)  Authorization  to  charge  nomi- 

24  nal  fee. — The  National  Coordinator  may  im- 

25  pose  a  nominal  fee  for  the  adoption  by  a  health 
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1  care  provider  of  the  health  mformation  tech- 

2  nology  system  developed  or  approved  under  sub- 

3  paragraph  (A).  Such  fee  shall  take  mto  account 

4  the  circumstances  of  smaller  providers  and  pro- 

5  viders  located  in  rural  or  other  medically  under- 

6  served  areas. 

7  "(D)  Open  source  defined. — In  this 

8  paragraph,  the  term  'open  source'  has  the 

9  meaning  given  such  term  by  the  Open  Source 

10  Initiative. 

11  "(5)  Nationwide  health  information  net- 

12  WORK. — The  National  Coordinator  shall  facilitate 

13  the   development   and   expansion   of  sub-national 

14  health  information  organizations  and  the  coordina- 

15  tion  of  such  organizations  in  order  to  provide  for  the 

16  nationwide  electronic  exchange  of  health  information 

17  among  such  organizations  that  ensures  that  appro- 

18  priate  information  is  available  at  the  time  and  place 

19  of  care  and  enables  the  aggregation  of  health  infor- 

20  mation  for  research  and  public  health  purposes. 

21  "(6)  Strategic  plan. — 

22  "(A)  In  general. — Not  later  than  12 

23  months  after  the  date  of  the  enactment  of  this 

24  title,  the  National  Coordinator  shall,  in  con- 

25  sultation  with  other  appi-oi)riate  P^ederal  agen- 
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1  cies  (including  the  National  Institute  of  Stand- 

2  ards  and  Technology),  develop  and  maintain  a 

3  strategic  plan  with  specific  objectives,  mile- 

4  stones,  and  metrics  for  each  strategic  plan  area 

5  described  in  subparagraph  (B).  The  National 

6  Coordinator  shall,  in  consultation  with  such 

7  other  appropriate  Federal  agencies,  annually 

8  update  such  strategic  plan. 

9  "(B)     Strategic    pi^an    areas  re- 

10  QUIRED. — The  strategic  plan  areas  include  at 

1 1  least  the  following: 

12  "(i)     The     establishment    of  rec- 

13  ommendations   for    and    development  of 

14  standards  and  guidance  for  each  category 

15  under  paragraph   (2) (A),   including  rec- 

16  ommendations  described  in  section  422  of 

17  the  Health-e  Information  Technology  Act 

18  of  2008,  and  the  adoption  of  standards  so 

19  recommended,  including  the  process  of  up- 

20  dating  of  such  standards  and  guidance. 

21  "(ii)  The  development  of  the  certifi- 

22  cation  program  under  paragraph  (3)  and 

23  the  establishment  and  maintenance  of  a 

24  list  of  health  information  technology  sys- 

25  tems  (and  components  of  such  systems) 
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1  that  have  been  certified  under  such  pro- 

2  gram. 

3  "(iii)  The  development  of  a  Federal 

4  open  source  health  IT  system  in  accord- 

5  ance  with  paragraph  (4). 

6  "(iv)   The  widespread  utilization  of 

7  electronic  health  records  in  the  United 

8  States  and  the  establishment  of  a  nation- 

9  wide  health  information  network  described 

10  in  paragraph  (5). 

11  "(v)  Specifying  a  framework  for  the 

12  coordination  and  flow  of  recommendations 

13  and  policies  under  this  subtitle  among  the 

14  Secretary,  the  National  Coordinator,  the 

15  HIT  Policy  Committee,  health  information 

16  exchanges,  and  other  relevant  entities. 

17  "(vi)  Methods  to  foster  the  public  un- 

18  derstanding  of  health  information  tech- 

19  nology  and  related  privacy  and  security 

20  laws. 

21  "(vii)  The  availability  of  technical  as- 

22  sistance  and  training  for  health  care  pro- 

23  viders  in  the  implementation  and  utiliza- 

24  tion  of  health  information  technology  sys- 

25  tems. 
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1  ''(C)  Collaboration. — The  strategic  plan 

2  shall  be  developed  and  updated  through  collabo- 

3  ration  of  public  and  private  interests. 

4  "(D)  Measurable  outcome  goals. — 

5  The  strategic  plan  shall  include  measurable  out- 

6  come  goals  including  timeframes  for  such  goals. 

7  "(E)  Publication. — The  National  Coor- 

8  dinator  shall  publish  the  strategic  plan,  includ- 

9  ing  all  updates. 

10  "(7)  Implementation  reports. — Not  later 

11  than  12  months  after  the  date  of  publication  of  the 

12  strategic  plan  under  paragraph  (6)  and  annually 

13  thereafter,  the  National  Coordinator  shall  submit  to 

14  the  Secretary  a  report  that  identifies  the  progress 

15  achieved  with  respect  to  the  objectives,  milestones, 

16  and  metrics  identified  in  such  strategic  plan  for  each 

17  strategic  plan  area  described  in  paragraph  (6)(B). 

18  "(8)  Assessment  of  impact  of  hit  on  com- 

19  munities  with  health  disparities  and  unin- 

20  sured,  underinsured,  and  medically  under- 

21  SERVED  AREAS. — The  National  Coordinator  shall  as- 

22  sess  and  publish  the  impact  of  health  information 

23  technology  in  communities  with  health  disparities 

24  and  in  areas  that  serve  uninsured,  underinsured, 

25  and  medically  under  served  individuals  (including 
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1  urban  and  rural  areas)  and  identify  practices  to  in- 

2  crease  the  adoption  of  such  technology  by  health 

3  care  providers  in  such  communities. 

4  "(9)    Website. — The    National  Coordinator 

5  shall  maintain  and  frequently  update  an  Internet 

6  website  on  which  there  is  posted  information  that  in- 

7  eludes  the  following: 

8  "(A)  Recommendations  made  by  the  Na- 

9  tional  Coordinator  under  paragraph  (2) (A). 

10  "(B)  The  standards  and  guidance  adopted 

11  by  the  Secretary  under  section  3003(a). 

12  "(C)  Sources  of  Federal  grant  funds  and 

13  technical  assistance  that  are  available  to  facili- 

14  tate  the  purchase  of,  or  enhance  the  utilization 

15  of,  health  information  technology  systems. 

16  "(D)  The  reports  prepared  by  the  National 

17  Coordinator  under  paragraph  (7). 

18  "(E)  The  assessment  by  the  National  Co- 

19  ordinator  under  paragraph  (8). 

20  "(d)  Staff.— 

21  "(1)  In  general. — The  National  Coordinator 

22  may  appoint  personnel  to  the  Office  as  the  National 

23  Coordinator  considers  appropriate.  Such  personnel 

24  shall  have  the  requisite  skills  needed  to  develop  and 

25  make  recommendations  in  each  of  the  categories  de- 
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1  scribed  in  clauses  (iii),  (iv),  and  (v)  of  subsection 

2  (c)(2)(A). 

3  "(2)  Detail  of  federal  employees. — 

4  ''(A)  In  general. — Upon  the  request  of 

5  the  National  Coordinator,  the  head  of  any  Fed- 

6  eral  agency  is  authorized  to  detail,  with  or  with- 

7  out  reimbursement  from  the  Office,  any  of  the 

8  personnel  of  such  agency  to  the  Office  to  assist 

9  it  in  carrying  out  its  duties  under  this  section. 

10  "(B)  Effect  of  detail. — ^Any  detail  of 

1 1  personnel  under  subparagraph  (A)  shall — 

12  "(i)  not  interrupt  or  otherwise  affect 

13  the  civil  service  status  or  privileges  of  the 

14  Federal  employee;  and 

15  "(ii)  be  in  addition  to  any  other  staff 

16  of  the  Department  employed  by  the  Na- 

17  tional  Coordinator. 

18  "(C)  Acceptance  of  detailees. — Not- 

19  withstanding  any  other  provision  of  law,  the  Of- 

20  fice  may  accept  detailed  personnel  from  other 

21  Federal  agencies  without  regard  to  whether  the 

22  agency  described  under  subparagraph  (A)  is  re- 

23  imbursed. 

24  "(3)  Temporary  and  intermittent  serv- 

25  ICES. — The  National  Coordinator  may  procure  tem- 
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1  porary   and   intermittent   services   under  section 

2  3109(b)  of  title  5,  United  States  Code  to  the  extent 

3  that  such  services  cannot  adequately  be  provided  by 

4  any  personnel  appointed  or  detailed  under  paragraph 

5  (1)  or  (2),  respectively. 

6  "(e)  Funding. — 

7  "(1)  Authorization  of  appropriations. — 

8  There  are  authorized  to  be  appropriated  to  carry  out 

9  this  section  such  sums  as  may  be  necessary  for  each 

10  of  the  fiscal  years  2009  through  2013. 

11  "(2)  DHHS  agency  contributions. — In  ad- 

12  dition  to  amounts  authorized  under  paragraph  (1), 

13  for  purposes  of  carrying  out  this  section,  for  each  of 

14  the  fiscal  years  2009  through  2013  there  shall  be 

15  transferred  to  the  National  Coordinator  from  the 

16  amount  appropriated  for  the  fiscal  year  to  each 

17  agency  within  the  Department  an  amount  that  is 

1 8  equal  to  1  percent  of  the  amount  appropriated  to  the 

19  agency  for  the  fiscal  year  to  carry  out  health  infor- 

20  mation  technology  activities. 

21  "(3)    Open    source    product  licensing 

22  FEE. — In  addition  to  amounts  authorized  under 

23  paragraph  (1)  and  transferred  under  paragraph  (2), 

24  any  fees  collected  under  subsection  (c)(4)(B)  shall  be 
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1  available  to  the  National  Coordinator  for  purposes  of 

2  carrying  out  this  section. 

3  "SEC.  3002.  HIT  ADVISORY  COMMITTEE. 

4  "(a)  Establishment. — There  is  estabhshed  a  HIT 

5  Advisory  Committee  to  make  recommendations  to  and  ad- 

6  vise  the  National  Coordinator  with  respect  to  all  of  the 

7  duties  of  the  National  Coordinator  described  in  section 

8  3001(c). 

9  "(b)  Additional  Duties. — 

10  "(1)  Forum. — The  HIT  Advisory  Committee 

11  shall  serve  as  a  forum  for  broad  stakeholder  input 

12  with  specific  expertise  necessary  to  advise  the  Na- 

13  tional  Coordinator  for  purposes  of  carrying  out  the 

14  duties  of  the  National  Coordinator  described  in  sec- 

15  tion  3001(c),  including  expertise  related  to  the  cat- 

16  egories  described  in  paragraph  (2)  (A)  of  such  sec- 

17  tion. 

18  "(2)  Website.— The  HIT  Advisory  Committee 

19  shall  develop  and  maintain  an  Internet  website  on 

20  which  there  is  posted  information  that  includes  the 

21  following: 

22  "(A)  Estabhshed  governance  rules. 

23  "(B)  A  business  plan. 

24  "(C)  Meeting  notices  at  least  14  days  prior 

25  to  each  meeting. 
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1  "(D)  Meeting  agendas  at  least  7  days  prior 

2  to  each  meeting. 

3  "(E)  Meeting  materials  at  least  3  days 

4  prior  to  each  meeting. 

5  "(c)  Membership. — 

6  "(1)    Appointments. — The    HIT  Advisory 

7  Committee  shall  be  composed  of  members  to  be  ap- 

8  pointed  as  follows: 

9  "(A)  Such  members  as  shall  be  appointed 

10  by  the   Secretary,   from  the  Department  of 

11  Health  and  Human  Services  as  representatives 

12  of  agencies  within  the  Department,  including 

13  from  the  Agency  for  Healthcare  Research  and 

14  Quality,  the  Centers  for  Disease  Control  and 

15  Prevention,  the  Centers  of  Medicare  &  Medicaid 

16  Services,  the  Health  Resources  and  Services 

17  Administration,  and  the  Indian  Health  Service. 

18  "(B)  1  member  shall  be  appointed  by  the 

19  majjority  leader  of  the  Senate. 

20  "(C)  1  member  shall  be  appointed  by  the 

21  minority  leader  of  the  Senate. 

22  "(D)  1  member  shall  be  appointed  b}^  the 

23  Speaker  of  the  House  of  Representatives. 
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1  "(E)  1  member  shall  be  appointed  by  the 

2  minority  leader  of  the  House  of  Representa- 

3  tives. 

4  "(F)  Such  other  members  as  shall  be  ap- 

5  pointed  by  the  President  as  representatives  of 

6  other  relevant  Federal  agencies,  such  as  the  De- 

7  partment  of  Veterans  Affairs,  the  National  In- 

8  stitute  of  Standards  and  Technology,  and  the 

9  Department  of  Defense. 

10  "(G)  12  members  shall  be  appointed  by  the 

11  Comptroller  General  of  the  United  States  of 

12  whom — 

13  "(i)  1  member  shall  be  an  advocate 

14  for  patients  or  consumers; 

15  "(ii)  2  members  shall  represent  health 

16  care  providers,  one  of  which  shall  be  a  phy- 

17  sician; 

18  "(iii)  1  member  shall  be  from  a  labor 

19  organization    representing    health  care 

20  workers; 

21  "(iv)  1  member  shall  have  expertise  in 

22  privacy  and  security; 

23  "(v)  1  member  shall  have  expertise  in 

24  improving  the  health  of  vulnerable  popu- 

25  lations; 
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1  "(vi)   1  member  shall  be  from  the 

2  health  research  community; 

3  "(vii)  1  member  shall  represent  health 

4  plans  or  other  third-party  payers; 

5  "(viii)  1  member  shall  represent  infor- 

6  mation  technology  vendors; 

7  "(ix)  1  member  shall  represent  pur- 

8  chasers  or  employers; 

9  "(x)  1  member  shall  have  expertise  in 

10  health  care  quality  measurement  and  re- 

11  porting;  and 

12  "(xi)  1  member  shall  have  expertise  in 

13  open  source  health  information  technology 

14  systems. 

15  In  no  case  may  the  total  number  of  members 

16  appointed  under  subparagraphs  (A)  and  (F)  ex- 

17  ceed  10. 

18  "(2)  National  coordinator. — The  National 

19  Coordinator  shall  be  a  member  of  the  HIT  Advisory 

20  Committee  and  act  as  a  liaison  between  the  Com- 

21  mittee  and  agencies  of  the  Federal  Government. 

22  "(3)  Chairperson  and  vice  chairperson. — 

23  The  HIT  Advisory  Committee  shall  designate  1 

24  member  to  serve  as  the  chairperson  and  1  member 

25  to  serve  as  the  vice  chairperson  of  the  HIT  Advisory 
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1  Committee,  such  that  one  is  a  representative  of  the 

2  pubhc  sector  and  one  is  a  representative  from  the 

3  private  sector. 

4  "(4)  Participation. — The  members  of  the 

5  HIT  Advisory  Committee  appointed  under  para- 

6  graph  (1)  shall  represent  a  balance  among  various 

7  sectors  of  the  health  care  system  so  that  no  single 

8  sector  unduly  influences  the  recommendations  of 

9  such  Committee. 

10  "(5)  Authorized  use  of  task  forces  and 

11  WORK  GROUPS. — The  National  Coordinator,  in  con- 

12  sultation  with  the  chairperson  and  vice  chairperson 

13  of  the  HIT  Advisory  Committee,  may  convene  task 

14  forces  or  working  groups  as  necessary  to  carry  out 

15  the  duties  of  the  Committee. 

16  "(6)  Compensation. — Subject  to  the  avail- 

17  ability  of  appropriations,  while  serving  on  the  busir 

18  ness  of  the  HIT  Advisoiy  Committee  (including 

19  traveltime),  a  member  of  the  Committee  who  is  not 

20  a  Federal  employee  shall  be  entitled  to  compensation 

21  at  the  per  diem  equivalent  of  the  rate  provided  for 

22  level  IV  of  the  Executive  Schedule  under  section 

23  5315  of  title  5,  United  States  Code;  and  while  so 

24  serving  away  from  home  and  the  member's  re^lar 

25  place  of  business,  a  member  may  be  allowed  travel 
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1  expenses,  as  authorized  by  the  Chairman  of  the 

2  Committee. 

3  "(7)  Terms.— 

4  "(A)  In  general. — The  terms  of  mem- 

5  bers  of  the  HIT  Advisory  Committee  appointed 

6  under  paragraph  (1)  shall  be  3  years  except 

7  that  the  Comptroller  General  of  the  United 

8  States  shall  designate  staggered  terms  for  the 

9  members    first    appointed    under  paragraph 

10  (1)(G). 

11  "(B)  Vacancies. — ^Any  member  appointed 

12  to  fill  a  vacancy  in  the  membership  of  the  HIT 

13  Advisory  Committee  that  occurs  prior  to  the  ex- 

14  piration  of  the  term  for  which  the  member's 

15  predecessor  was  appointed  shall  be  appointed 

16  only  for  the  remainder  of  that  term.  A  member 

17  may  serve  after  the  expiration  of  that  member's 

18  term  until  a  successor  has  been  appointed.  A 

19  vacancy  in  the  HIT  Advisory  Committee  shall 

20  be  filled  in  the  manner  in  which  the  original  ap- 

21  pointment  was  made. 

22  "(8)  Outside  involvement. — The  HIT  Advi- 

23  sory  Committee  shall  ensure  an  adequate  oppor- 

24  tunity  for  the  participation  in  activities  of  the  Com- 

25  mittee  of  outside  advisors,  including  individuals  with 


•HR  6898  IH 


32 

1  expertise  in  the  development  of  policies  for  the  elec- 

2  tronic  exchange  and  use  of  health  information,  in- 

3  eluding  in  the  areas  of  health  information  privacy 

4  and  security. 

5  "(9)  Quorum. — Ten  members  of  the  HIT  Advi- 

6  sory  Committee  shall  constitute  a  quorum  for  pur- 

7  poses  of  voting,  but  a  lesser  number  of  members 

8  may  meet  and  hold  hearings. 

9  "(d)  Application  of  FACA. — The  Federal  Advisory 

10  Committee  Act  (5  U.S.C.  App.),  other  than  section  14  of 

1 1  such  Act,  shall  apply  to  the  HIT  Advisory  Committee. 

12  "(e)  Publication. — The  Secretary  shall  provide  for 

13  publication  in  the  Federal  Register  and  the  posting  on  the 

14  Internet  website  of  the  Office  of  the  National  Coordinator 

15  for  Health  Information  Technology  of  all  policy  rec- 

16  ommendations  made  by  the  HIT  Advisory  Committee 

17  under  this  section. 

18  "SEC.  3003.  PROCESS  FOR  ADOPTION  OF  RECOMMENDED 

19  STANDARDS  AND  GUIDANCE. 

20  "(a)  In  General. — 

21  "(1)  Standards. — Not  later  than  9  months 

22  after  the  date  of  receipt  of  a  recommendation  under 

23  section  3001(c)(2)  from  the  National  Coordinator 

24  for  any  grouping  of  standards  for  purposes  of  certi- 

25  fying  health  information  technology  under  the  cer- 
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1  tification  program  under  section  3001(c)(3),  the 

2  Secretary  shall,  through  a  rulemaking  process  and 

3  after  consideration  of  public  comments,  determine 

4  whether  or  not  to  adopt  such  grouping  of  standards. 

5  "(2)  Guidance. — Not  later  than  9  months 

6  after  the  date  of  receipt  of  a  recommendation  under 

7  section  3001(c)(2)  from  the  National  Coordinator 

8  for  any  guidance,  the  Secretary  shall,  through  the 

9  applicable  administrative  process  that  includes  public 

10  notice  in  the  Federal  Register  and  opportunity  for 

11  public  comment,  determine  whether  or  not  to  adopt 

12  such  guidance. 

13  "(b)  Initial  Standards. — Not  later  than  Sep- 

14  tember  30,  2011,  the  Secretary  shall,  through  a  rule- 

15  making  process  and  after  consideration  of  public  com- 

16  ments,  adopt  the  initial  set  of  standards  recommended 

17  from  the  National  Coordinator  pursuant  to  the  second 

18  sentence  under  section  3001(c)(2).  Such  initial  set  of 

19  standards  shall  include,  at  a  minimum,  technical  stand- 

20  ards  for  de-identifying  health  information  and  for  immu- 

21  table  audit  trails. 

22  "(c)  Publication. — Not  later  than  30  days  after  the 

23  Secretary  makes  a  determination  under  subsection  (a),  the 

24  Secretary  shall  provide  for  publication  in  the  Federal  Reg- 

25  ister,  and  on  the  Internet  website  maintained  by  the  Na- 
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1  tional  Coordinator  in  accordance  with  section  3001(c)(9), 

2  of  such  determination. 

3  "SEC.  3004.  APPLICATION  AND  USE  OF  ADOPTED  STAND- 

4  ARDS  BY  FEDERAL  AGENCIES. 

5  "For  requirements  relating  to  the  apphcation  and  use 

6  by  Federal  agencies  of  the  standards  adopted  under  sec- 

7  tion  3003(a),  see  section  111  of  the  Health-e  Information 

8  TechnologyAct  of  2008. 

9  "SEC.  3005.  VOLUNTARY  APPLICATION  AND  USE  OF  ADOPT- 

10  ED  STANDARDS  BY  PRIVATE  ENTITIES. 

11  "(a)  In  General. — Except  as  provided  under  section 

12  112  of  the  Health-e  Information  Technology  Act  of  2008, 

13  any  standard  adopted  under  section  3003(a)  shall  be  vol- 

14  untary  with  respect  to  private  entities. 

15  "(b)  Rule  of  Construction. — Nothing  in  this  sub- 

16  title  shall  be  construed  to  require  that  a  private  entity  that 

17  enters  into  a  contract  with  the  Federal  Government  apply 

18  or  use  the  standards  adopted  under  section  3003(a)  with 

19  respect  to  activities  not  related  to  the  contract.  The  pre- 

20  vious  sentence  shall  not  affect  any  other  provision  of  law, 

21  such  as  part  C  of  title  XI  of  the  Social  Security  Act,  title 

22  III  of  the  Health-e  Information  Technology  Act  of  2008, 

23  or  regulations  promulgated  to  carry  out  section  264(c)  of 

24  the  Health  Insurance  Portability  and  Accountability  Act 
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1  of  1996,  that  requires  the  appheation  or  use  of  such  a 

2  standard. 

3  "SEC.    3006.    HEALTH    INFORMATION    TECHNOLOGY  RE- 


4  SOURCE  CENTER. 

5  "(a)  Development. — 

6  "(1)  In  general. — The  National  Coordinator 

7  shall  develop  a  Health  Information  Technology  Re- 

8  source  Center  to  provide  technical  assistance  and  de- 

9  velop  best  practices  to  support  and  accelerate  efforts 

10  to  adopt,  implement,  and  effectively  use  health  infor- 

11  mation  technology  that  allows  for  the  electronic  ex- 

12  change  and  use  of  information  in  compliance  with 

13  standards  and  any  guidance  adopted  under  section 

14  3003(a),  including  for  purposes  of  each  of  the  cat- 

15  egories  described  in  such  section  3001(c)(2). 

16  "(2)  Purposes. — The  purpose  of  the  Center  is 

17  to— 

18  ''(A)  provide  a  forum  for  the  exchange  of 

19  knowledge  and  experience; 

20  "(B)   accelerate  the  transfer  of  lessons 

21  learned  from  existing  public  and  private  sector 

22  initiatives,  including  those  currently  receiving 

23  Federal  financial  support; 

24  "(C)  assemble,  analyze,  and  widely  dis- 

25  seminate  evidence  and  experience  related  to  the 
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1  adoption,  implementation,  and  effective  use  of 

2  health  information  technology  that  allows  for 

3  the  electronic  exchange  and  use  of  information; 

4  "(D)  provide  technical  assistance  for  the 

5  establishment  and  evaluation  of  regional  and 

6  local  health  information  networks  to  facilitate 

7  the  electronic  exchange  of  information  across 

8  health  care  settings  and  improve  the  quality  of 

9  health  care; 

10  "(E)  provide  technical  assistance  for  the 

11  development  and  dissemination  of  solutions  to 

12  barriers  to  the  exchange  of  electronic  health  in- 

13  formation; 

14  "(F)  learn  about  effective  strategies  to 

15  adopt  and  utilize  health  information  technology 

16  in  medically  underserved  communities; 

17  "(G)  conduct  other  activities  identified  by 

18  the  States,  local  or  regional  health  information 

19  networks,  or  health  care  stakeholders  as  a  focus 

20  for  developing  and  sharing  best  practices;  and 

21  "(H)  provide  technical  assistance  to  pro- 

22  mote  adoption  and  utilization  of  health  informa- 

23  tion  technology  by  health  care  providers,  includ- 

24  ing  in  medically  underserved  communities. 
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1  "(b)  Technical  Assistance  Telephone  Number 

2  OR  Website. — The  National  Coordinator  shall  establish 

3  a  toll-free  telephone  number  or  Internet  website  to  provide 

4  health  care  providers  with  a  single  point  of  contact  to — 

5  "(1)  learn  about  Federal  grants  and  technical 

6  assistance  services  related  to  the  electronic  exchange 

7  and  use  of  health  information; 

8  "(2)  learn  about  standards  adopted  under  sec- 

9  tion  3003(a); 

10  "(3)  learn  about  regional  and  local  health  infor- 

11  mation  networks  for  assistance  with  health  informa- 

12  tion  technology;  and 

13  "(4)  disseminate  additional  information  deter- 

14  mined  by  the  National  Coordinator.". 

15  SEC.  102.  TRANSITIONS. 

16  (a)  ONCHIT. — To  the  extent  consistent  with  section 


17  3001  of  the  Public  Health  Service  Act,  as  added  by  section 

18  101,  all  functions,  personnel,  assets,  liabilities,  and  admin- 

19  istrative  actions  applicable  to  the  National  Coordinator  for 

20  Health  Information  Technology  appointed  under  Execu- 

21  tive  Order  13335  or  the  Office  of  such  National  Coordi- 

22  nator  on  the  date  before  the  date  of  the  enactment  of  this 

23  Act  shall  be  transferred  to  the  National  Coordinator  ap- 

24  pointed  under  section  3001(a)  of  such  Act  and  the  Office 
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1  of  such  National  Coordinator  as  of  the  date  of  the  enact- 

2  ment  of  this  Act. 

3  (b)  AHIC. — To  the  extent  consistent  with  section 

4  3002  of  the  Pubhc  Health  Service  Act,  as  added  by  section 

5  101,  all  functions,  personnel,  assets,  and  liabilities  applica- 

6  ble  to  the  American  Health  Information  Community  cre- 

7  ated  in  response  to  Executive  Order  13335  as  of  the  day 

8  before  the  date  of  the  enactment  of  this  Act  shall  be  trans- 

9  ferred  to  the  HIT  Advisory  Committee,  established  under 

10  section  3002 (a)of  such  Act,  as  appropriate,  as  of  the  date 

11  of  the  enactment  of  this  Act. 

12  (c)  Rules  op  Construction. — 

13  (1)  ONCHIT.— Nothing  in  section  3001  of  the 

14  Public  Health  Service  Act,  as  added  by  section  101, 

15  or  subsection  (a)  shall  be  construed  as  requiring  the 

16  creation  of  a  new  entity  to  the  extent  that  the  Office 

17  of  the  National  Coordinator  for  Health  Information 

18  Technology  established  pursuant  to  Executive  Order 

19  13335  is  consistent  with  the  provisions  of  such  sec- 

20  tion  3001. 

21  (2)  AHIC— Nothing  in  section  3002  of  the 

22  Public  Health  Service  Act,  as  added  by  section  101, 

23  or  subsection  (b)  shall  be  construed  as  requiring  the 

24  creation  of  a  new  entity  to  the  extent  that  the  Amer- 

25  ican  Health  Information  Community  created  in  re- 
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1  sponse  to  Executive  Order  13335  is  consistent  with 

2  the  provisions  of  such  section  3002. 

3  Subtitle  B — ^Application  and  Use  of 

4  Adopted     Health  Information 

5  Technology  Standards;  Reports 

6  SEC.  111.  COORDINATION  OF  FEDERAL  ACTIVITIES  WITH 

7  ADOPTED  STANDARDS. 

8  (a)  Spending  on  Heai^th  Information  Tech- 

9  nology  Systems. — As  each  agency  (as  defined  in  the  Ex- 

10  ecutive  Order  issued  on  August  22,  2006,  relating  to  pro- 

1 1  moting  quahty  and  efficient  heahh  care  in  Federal  govern- 

12  ment  administered  or  sponsored  health  care  programs)  im- 

13  plements,  acquires,  or  upgrades  health  information  tech- 

14  nology  systems  used  for  the  direct  exchange  of  individually 

15  identifiable  health  information  between  agencies  and  with 

16  non-Federal  entities,  it  shall  utilize,  where  available, 

17  health  information  technology  systems  and  products  that 

18  meet  standards  adopted  under  section  3003(a)  of  the  Pub- 

19  lie  Health  Service  Act,  as  added  by  section  101. 

20  (b)  Federal  Information  Collection  Activi- 

21  TIES. — ^With  respect  to  a  standard  adopted  under  section 

22  3003(a)  of  the  Public  Health  Service  Act,  as  added  by 

23  section  101,  the  President  shall  take  measures  to  ensure 

24  that  Federal  activities  involving  the  broad  collection  and 

25  submission  of  health  information  are  consistent  with  such 
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1  standard  within  three  years  after  the  date  of  such  adop- 

2  tion. 

3  (c)  Application  of  Definitions. — The  definitions 

4  contained  in  section  3000  of  the  Pubhc  Health  Service 

5  Act,  as  added  by  section  101,  shall  apply  for  purposes  of 

6  this  part. 

7  SEC.  112.  APPLICATION  TO  PRIVATE  ENTITIES. 

8  Each  agency  (as  defined  in  such  Executive  Order 

9  issued  on  Aug-ust  22,  2006,  relating  to  promoting  quality 

10  and  efficient  health  care  in  Federal  government  adminis- 

11  tered  or  sponsored  health  care  programs)  shall  require  in 

12  contracts  or  agreements  with  health  care  providers,  health 

13  plans,  or  health  insurance  issuers  that  as  each  provider, 

14  plan,  or  issuer  implements,  acquires,  or  upgrades  health 

15  information  technology  systems,  it  shall  utilize,  where 

16  available,  health  information  technology  systems  and  prod- 

17  ucts  that  meet  standards  adopted  under  section  3003(a) 

18  of  the  Public  Health  Service  Act,  as  added  by  section  101. 

19  SEC.  113.  ANNUAL  REPORTS. 

20  Not  later  than  2  years  after  the  date  of  the  enact- 

21  ment  of  this  Act  and  annually  thereafter,  the  Secretary 

22  of  Health  and  Human  Services  shall  submit  to  the  Com- 

23  mittee  on  Finance,  the  Committee  on  Health,  Education, 

24  Labor,  and  Pensions  and  the  Committee  on  Commerce, 

25  Science,  and  Transportation  of  the  Senate  and  the  Com- 
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1  mittee  on  Ways  and  Means,  the  Committee  on  Energy  and 

2  Commerce,  and  the  Committee  on  Science  and  Technology 

3  of  the  House  of  Representatives  a  report  that — 

4  (1)  describes  the  specific  actions  that  have  been 

5  taken  by  the  Federal  Government  and  private  enti- 

6  ties  to  facilitate  the  adoption  of  a  nationwide  system 

7  for  the  electronic  use  and  exchange  of  health  infor- 

8  mation,  including  information  from  the  implementa- 

9  tion  reports  submitted  under  section  3001(c)(7)  of 

10  the  Public  Health  Service  Act,  as  added  by  section 

11  101; 

12  (2)  describes  barriers  to  the  adoption  of  such  a 

13  nationwide  system;  and 

14  (3)  contains  recommendations  to  achieve  full 

15  implementation  of  such  a  nationwide  system. 

16  TITLE  II— TESTING  OF  HEALTH 

17  INFORMATION  TECHNOLOGY 

18  SEC.  201.  NATIONAL  INSTITUTE  FOR  STANDARDS  AND 

19  TECHNOLOGY  TESTING. 

20  (a)  Pilot  Testing  of  Standards  and  Implemen- 

21  TATION  Specifications. — In  coordination  with  the  Office 

22  of  the  National  Coordinator  of  Health  Information  Tech- 

23  nology  established  under  section  3001  of  the  Public 

24  Health  Service  Act,  as  added  by  section  101,  with  respect 

25  to  the  development  of  standards  under  such  section,  the 
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1  Director  of  the  National  Institute  for  Standards  and  Tech- 

2  nology  shall  test  such  standards  in  order  to  assure  the 

3  efficient  implementation  and  use  of  such  standards. 

4  (b)  Voluntary  Testing  Program. — In  coordina- 

5  tion  with  the  Office  of  the  National  Coordinator  of  Health 

6  Information  Technology  estabhshed  under  section  3001  of 

7  the  Public  Health  Service  Act,  as  added  by  section  101, 

8  with  respect  to  the  development  of  standards  under  such 

9  section,  the  Director  of  the  National  Institute  of  Stand- 

10  ards  and  Technology  shall  support  the  establishment  of 

11  a  conformance  testing  infrastructure,  including  the  devel- 

12  opment  of  technical  test  beds.  The  development  of  this 

13  conformance  testing  infrastructure  may  include  a  program 

14  to  accredit  independent,  non-Federal  laboratories  to  per- 

15  form  testing. 

16  TITLE      III— INCENTIVES  FOR 

17  ADOPTION    OF    HEALTH  IN- 

18  FORMATION  TECHNOLOGY 

19  Subtitle  A — Medicare  Program 

20  SEC.  301.  INCENTIVES  FOR  ELIGIBLE  PROFESSIONALS. 

21  (a)  Incentive  Payments. — Section  1848  of  the  So- 

22  cial  Security  Act  (42  U.S.C.  1395w-4)  is  amended  by  add- 

23  ing  at  the  end  the  following  new  subsection: 
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1  "(o)  Incentrhes  for  Adoption  and  Meaningful 

2  Use  of  Certified  Health  Information  Technology 

3  System. — 

4  "(1)  Incentive  payments. — 

5  "(A)  In  general. — Subject  to  subpara- 

6  graphs  (B),  (C),  and  (D),  mth  respect  to  cov- 

7  ered  professional  services  furnished  by  an  ehgi- 

8  ble  professional  during  a  reporting  period  dur- 

9  ing  the  first  calendar  year  beginning  after  the 

10  date  specified  under  subparagraph  (B)(iv)  (or, 

11  if  sooner,  2013)  or  any  subsequent  year  (before 

12  2017),  if  the  eligible  professional  is  a  meaning- 

13  ful  HIT  user  for  the  reporting  period  (as  deter- 

14  mined  under  paragraph  (2),  in  addition  to  the 

15  amount  otherwise  paid  under  this  part,  there 

16  also  shall  be  paid  to  the  eligible  professional  (or 

17  to  an  employer  or  facility  in  the  cases  described 

18  in  clause  (A)  of  section  1842(b)(6))  or,  in  the 

19  case   of  a  group  practice  under  paragraph 

20  (2)(D),  to  the  group  practice,  from  the  Federal 

21  Supplementary  Medical  Insurance  Trust  Fund 

22  established  under  section  1841  an  amount  equal 

23  to  75  percent  of  the  Secretary's  estimate  (based 

24  on  claims  submitted  not  later  than  2  months 

25  after  the  end  of  the  reporting  period)  of  the  al- 
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1  lowed  charges  under  this  part  for  all  such  cov- 

2  ered  professional  services  furnished  by  the  eligi- 

3  ble  professional  (or,  in  the  case  of  a  group  prac- 

4  tice  under  paragraph  (2)(D),  by  the  group 

5  practice)  during  the  reporting  period. 

6  "(B)  Limitations  on  amounts  of  in- 

7  CENTIVE  PAYMENTS. — 

8  "(i)  In  general. — In  no  case  shall 

9  the  amount  of  the  incentive  pajnnent  pro- 

10  vided  under  this  paragraph  exceed  the  ap- 

1 1  plicable  amount  specified  in  clause  (ii)  with 

12  respect  to  any  eligible  professional. 

13  "(ii)   Amount. — Subject   to  clauses 

14  (iii)  and  (iv),  the  applicable  amount  speci- 

15  fied  in  this  clause  is  as  follows: 

16  "(I)  For  the  first  calendar  year 

17  beginning  after  the  date  specified  in 

18  clause  (iv)  or,  if  sooner,  for  2013, 

19  $15,000. 

20  "(II)  For  the  calendar  year  fol- 

21  lowing  the  year  specified  in  subclause 

22  (I),  $12,000. 

23  "(III)  For  the  calendar  year  fol- 

24  lowing  the  year  specified  in  subclause 

25  (II),  $8,000. 
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1  "(IV)  For  the  calendar  year  fol- 

2  lowing  the  year  specified  in  subclause 

3  (III),  $4,000. 

4  "(V)  For  the  calendar  year  fol- 

5  lowing  the  year  specified  in  subclause 

6  (IV),  $2,000. 

7  "(iii)  Pro-ration  for  partial  year 

8  PROFESSIONALS. — In  the  case  of  an  eligi- 

9  ble  professional  who  is  a  meaningful  HIT 
10  user  for  only  a  portion  of  a  reporting  pe- 
ll riod  for  reasons  such  as  the  professional 

12  did  not  provide  services  for  which  payment 

13  is  made  under  this  part  for  the  entire  pe- 

14  riod  or  the  professional  initiated  the  use  of 

15  health  information  technology  during  the 

16  period,  the  Secretary  may  pro-rate  the  ap- 

17  plicable  amount  specified  under  clause  (ii) 

18  to  reflect  the  portion  of  the  period  during 

19  which  the  professional  was  a  meaningful 

20  HIT  user. 

21  "(iv)   Date    specified. — The  date 

22  specified  in  this  subclause  is  the  date  on 

23  which  the  open  source  health  information 

24  technology      system       under  section 
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1  3001(c)(4)  of  the  Public  Health  Service 

2  Act  is  first  made  publicly  available. 

3  "(C)    Non-application   to  hospital- 

4  BASED  ELIGIBLE  PROFESSIONALS. — 

5  "(i)  In  general. — No  payment  may 

6  be  made  under  subparagraph  (A)  in  the 

7  case  of  hospital-based  eligible  professionals. 

8  "(ii)  Hospital-based  eligible  pro- 

9  FESSIONAL. — For  purposes  of  clause  (i), 

10  the  term  'hospital-based  eligible  profes- 

11  sional'  means  an  eligible  professional,  such 

12  as  a  pathologist  or  anesthesiologist,  who 

13  furnishes  items  and  services  principally  in 

14  a  hospital  setting  and  through  the  use  of 

15  the   facilities    and   equipment,  including 

16  computer  equipment,  of  the  hospital. 

17  "(D)  Form  of  payment. — The  payment 

18  under  this  subsection  for  a  reporting  period 

19  may  be  in  the  form  of  a  single  consolidated  pay- 

20  ment  or  in  the  form  of  such  periodic  install- 

21  ments  as  the  Secretary  may  specify. 

22  "(2)  Meaningful  hit  user. — 

23  "(A)  In  general. — For  purposes  of  para- 

24  graph  (1),   an  ehgible  professional  shall  be 

25  treated  as  a  meaningful  HIT  user  for  a  report- 
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1  ing  period  for  a  year  if  the  eligible  professional 

2  demonstrates  to  the  satisfaction  of  the  Sec- 

3  retary  that  the  professional  is  meaningfally 

4  using  a  certified  health  information  technology 

5  system  during  the  reporting  period,  as  dem- 

6  onstrated  in  accordance  with  applicable  meas- 

7  ures  established  under  subparagraph  (B). 

8  "(B)  Measures  for  meaningful  use. — 

9  The  Secretary  shall  establish  measures  under 

10  which  an  eligible  professional  may  demonstrate 

11  meaningful  use  of  a  certified  health  information 

12  technology  system  for  a  reporting  period.  Such 

13  measures  may  include — 

14  "(i)    self-certification   of  operational 

15  use  of  such  a  system; 

16  "(ii)  the  submission  (or  ability  to  sub- 

17  mit),  in  a  form  and  manner  specified  by 

18  the  Secretary,  of  such  information  on  clin- 

19  ical  measures  and  data  (that  does  not  in- 

20  elude  individually  identifiable  health  infor- 

21  mation)  from  such  system  that  indicates  a 

22  meaningful  utilization  of  such  a  system 

23  during  the  period;  and 

24  "(iii)  such  other  means  as  the  See- 

25  retary  may  specify. 
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1  The  Secretary  may  establish  and  apply  different 

2  measures  based  on  the  stage  of  implementation 

3  or  adoption  of  the  certified  health  information 

4  technology  system  involved. 

5  "(C)  Use  of  part  d  data. — Notwith- 

6  standing    sections     1860D-1 5  (d)(2)(B)  and 

7  1860D-1 5 (f)(2),  the  Secretary  may  use  data 

8  regarding  drug  claims  submitted  for  purposes 

9  of  section  1860D-15  that  are  necessary  for 

10  purposes  of  subparagraph  (B)(ii). 

11  "(D)    Satisfactory    measures  for 

12  GROUP  PRACTICES. — 

13  "(i)   In  general. — Not  later  than 

14  January  1,  2013,  the  Secretary  shall  pro- 

15  vide  for  a  method  of  applying  the  measures 

16  established  under  subparagraph  (B)  or  re- 

17  vised  under  subparagraph  (F)  to  eligible 

18  professionals  in  a  group  practice  (as  de- 

19  fined  by  the  Secretary). 

20  "(ii)  Statistical  sampling 

21  model. — In  the  case  that  the  Secretary 

22  provides  for  a  method  under  clause  (i),  the 

23  method  may  provide  for  the  use  of  a  statis- 

24  tical  sampling  model  to  submit  data  on 

25  measures,  such  as  the  model  used  under 
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1  the  Physician  Group  Practice  demonstra- 

2  tion  project  under  section  1866A. 

3  "(iii)   No  DOUBLE  PAYMENTS. — Pay- 

4  ments  for  a  reporting  period  to  a  group 

5  practice  under  this  paragraph  by  reason  of 

6  the  method  under  clause  (i)  shall  be  in  lieu 

7  of  the  payments  that  would  otherwise  be 

8  made  under  this  paragraph  to  eligible  pro- 

9  fessionals  in  the  group  practice  for  being  a 

10  meaningful  HIT  user  during  such  period. 

11  "(E)  Authority  to  rewse  measures. — 

12  The  Secretary  may  periodically  revise  the  meas- 

13  ures  established  under  subparagraph  (B)  with 

14  respect  to  demonstrating  meaningful  use  of  a 

15  certified  health  information  technology  system. 

16  "(3)  Application. — 

17  "(A)    Physician    reporting  system 

18  RULES. — Paragraphs  (5),  (6), and  (8)  of  sub- 

19  section  (k)  shall  apply  for  purposes  of  this  sub- 

20  section  in  the  same  manner  as  they  apply  for 

21  purposes  of  such  subsection. 

22  "(B)  Coordination  with  other  bonus 

23  PAYMENTS. — The  provisions  of  this  subsection 

24  shall  not  be  taken  into  account  in  appl}dng  sub- 

25  sections  (m)  and  (u)  of  section  1833  and  any 
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1  payment  under  such  subsections  shall  not  be 

2  taken   into   account   in   computing  allowable 

3  charges  under  this  subsection. 

4  "(C)   Limitations   on  review. — There 

5  shall  be  no  administrative  or  judicial  review 

6  under  1869,  section  1878,  or  otherwise  of — 

7  "(i)  the  determination  of  measures 

8  apphcable  to  services  furnished  by  eligible 

9  professionals  under  this  subsection; 

10  "(ii)  the  determination  of  a  meaning- 

11  ful  HIT  user  under  paragraph  (2) (A),  a 

12  limitation  under  paragraph  (1)(B),  and  the 

13  exception  under  subsection  (a)(7)(B);  and 

14  "(iii)  the  determination  of  any  incen- 

15  live  payment  under  this  subsection  and  the 

16  payment    adjustment    under  subsection 

17  (a)(7)(A). 

18  "(D)  Posting  on  website. — The  Sec- 

19  retary  shall  post  on  the  Internet  website  of  the 

20  Centers  for  Medicare  &  Medicaid  Services,  in  an 

21  easily  understandable  format,   a  list  of  the 

22  names,  business  addresses,  and  business  phone 

23  numbers  of  the  eligible  professionals  (or,  in  the 

24  case  of  reporting  under  paragraph  (2)(D),  the 
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1  group   practices)   who   are   meaningful  HIT 

2  users. 

3  "(4)  Definitions. — For  purposes  of  this  sub- 

4  section: 

5  "(A)  Certified  health  information 

6  TECHNOLOGY    SYSTEM. — The    term  'certified 

7  health  information  technology  system'  means, 

8  with  respect  to  an  eligible  professional  and  a  re- 

9  porting  period  for  a  year,  a  health  information 

10  technology  system  (as  defined  in  section  3000 

11  of  the  Public  Health  Service  Act)  that  has  a 

12  current  certification  under  section  3001(c)(3)  of 

13  such  Act  as  satisfying  all  interoperability  stand- 

14  ards,  privacy  and  security  standards,  and  clin- 

15  ical  and  quality  functions  adopted  under  section 

16  3003(a)  of  such  Act  that  are  applicable  to  the 

17  eligible  professional. 

18  "(B)      CO^^RED      PROFESSIONAL  SERV- 

19  ICES. — The  term  'covered  professional  services' 

20  has  the  meaning  given  such  term  in  subsection 

21  (k)(3). 

22  "(C)  Eligible  professional. — The  term 

23  'eligible  professional'  means  a  physician,  as  de- 

24  fined  in  section  1861(r)(l). 
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1  "(D)  Reporting  period. — The  term  're- 

2  porting  period'  means  any  period,  with  respect 

3  to  a  calendar  year,  as  specified  by  the  Sec- 

4  retary.". 

5  (b)  Incentive  Payment  Adjustment. — Section 

6  1848(a)  of  the  Social  Security  Act  (42  U.S.C.  1395w- 

7  4(a))  is  amended  by  adding  at  the  end  the  following  new 

8  paragraph: 

9  "(7)  Incentives  for  meaningful  use  of 

10  HEALTH  information  TECHNOLOGY  SYSTEMS. — 

11  "(A)  Adjustment. — 

12  "(i)  In  general. — Subject  to  sub- 

13  paragraph  (B),  with  respect  to  covered 

14  professional  services  furnished  by  an  eligi- 

15  ble  professional  during  2016  or  any  subse- 

16  quent  year,  if  the  eligible  professional  is 

17  not  a  meaningful  HIT  user  for  a  reporting 

18  period  for  the  year  (as  determined  under 

19  subsection  (o)(2)),  the  fee  schedule  amount 

20  for  such  services  furnished  by  such  profes- 

21  sional  during  the  year  (including  the  fee 

22  schedule  amount  for  purposes  of  deter- 

23  mining  a  payment  based  on  such  amount) 

24  shall  be  equal  to  the  applicable  percent  of 

25  the  fee  schedule  amount  that  would  other- 
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1  wise  apply  to  such  services  under  this  sub- 

2  section   (determined  after  apphcation  of 

3  paragraph  (3)  but  mthout  regard  to  this 

4  paragraph) . 

5  "(ii)    Applicable    percent. — For 

6  purposes  of  clause  (i),  the  term  'applicable 

7  percent'  means — 

8  "(I)  for  2016,  99  percent; 

9  "(II)  for  2017,  98.5  percent; 

10  "(III)  for  2018,  98  percent; 

11  "(IV)   for  2019,   97.5  percent; 

12  and 

13  "(V)  for  2020  and  each  subse^ 

14  quent  year,  97  percent. 

15  "(B)    Significant    hardship  excep- 

16  TION. — The  Secretary  may,  on  a  ease-by-case 

17  basis,  exempt  an  eligible  professional  from  the 

18  application  of  the  payment  adjustment  under 

19  subparagraph  (A)  if  the  Secretary  determines, 

20  subject  to  annual  renewal,  that  compliance  with 

21  the  requirement  for  being  a  meaningful  HIT 

22  user  would  result  in  a  significant  hardship,  such 

23  as  in  the  case  of  an  eligible  professional  who 

24  practices  in  a  rural  area  without  sufficient 

25  Internet  access.  In  no  case  may  an  eligible  pro- 
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1  fessional  be  granted  an  exemption  under  this 

2  subparagraph  for  more  than  5  years. 

3  "(C)  Application  of  physician  report- 

4  ING  SYSTEM  RULES. — Paragraphs  (5),  (6),  and 

5  (8)  of  subsection  (k)  shall  apply  for  purposes  of 

6  this  paragraph  in  the  same  manner  as  they 

7  apply  for  purposes  of  such  subsection. 

8  ''(D)     NON- APPLICATION     TO  HOSPITAL- 

9  BASED    ELIGIBLE    PROFESSIONALS. — No  pay- 

10  ment  adjustment  may  be  made  under  subpara- 

11  graph  (A)  in  the  case  of  hospital-based  eligible 

12  professionals     (as     defined     in  subsection 

13  (o)(l)(C)(ii)). 

14  "(E)  Definitions. — For  purposes  of  this 

15  paragraph: 

16  "(i)  Covered  professional  serv- 

17  ICES. — The    term    'covered  professional 

18  services'  has  the  meaning  given  such  term 

19  in  subsection  (k)(3). 

20  "(ii)  Eligible  professional. — The 

21  term  'eligible  professional'  means  a  physi- 

22  cian,  as  defined  in  section  1861  (r)(l). 

23  "(iii)  Reporting  period. — The  term 

24  'reporting  period'  means,  with  respect  to  a 

25  year,  a  period  specified  by  the  Secretary.". 


HR  6898  IH 


55 

1  (c)     Conforming    Amendments    to  e-Pre- 

2  SCRIBING. — 

3  (1)  Section  1848(a)(5)(A)(ii)(III)  of  the  Social 

4  Security  Act  (42  U.S.C.  1395w-4(a)(5)(A)(ii)(III)) 

5  is  amended  by  striking  "and  each  subsequent  year" 

6  and  inserting  "and  2015". 

7  (2)  Section  1848(m)(2)  of  the  Social  Security 

8  Act  (42  U.S.C.  1395w-4(m)(2))  is  amended— 

9  (A)  in  subparagraph  (A),  by  striking  "For 

10  2009"  and  inserting  "Subject  to  subparagraph 

11  (D),  for  2009";  and 

12  (B)  by  adding  at  the  end  the  following  new 

13  subparagraph: 

14  "(D)    Limitation   with   respect  to 

15  HEALTH    information    TECHNOLOGY  INCEN- 

16  TIVE  PAYMENTS. — The  provisions  of  this  para- 

17  graph  shall  not  apply  to  an  eligible  professional 

18  (or,  in  the  case  of  a  group  practice  under  para- 

19  graph  (3)(C),  to  the  group  practice)  if,  for  the 

20  reporting  period  the  eligible  professional  (or 

21  group  practice)  receives  an  incentive  payment 

22  under  subsection  (o)(l)(A)  with  respect  to  a 

23  certified  health  information  system  (as  defined 

24  in  subsection  (o)(4)(A))  that  has  the  capability 

25  of  electronic  prescribing.". 
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1  (d)  GAO  Study  and  Report. — 

2  (1)  Study. — The  Comptroller  General  of  the 

3  United  States  shall  conduct  a  study  to  determine  the 

4  extent  to  which  and  manner  in  which  payment  in- 

5  centives  (such  as  under  title  XVIII  or  XIX  of  the 

6  Social  Security  Act)  and  other  fanding  for  purposes 

7  of  implementing  and  using  health  information  tech- 

8  nology  should  be  made  available  to  health  care  pro- 

9  viders  who  are  receiving  minimal  or  no  payment  in- 

10  centives  or  other  funding  under  this  Act,  under  title 

11  XVIII  or  XIX  of  the  Social  Security  Act,  or  other- 

12  wise,  for  such  purposes.  Such  study  shall  include  an 

13  examination  of — 

14  (A)  the  adoption  rates  of  certified  health 

15  information  technology  systems  by  such  health 

16  care  providers; 

17  (B)  the  clinical  utility  of  such  systems  by 

18  such  health  care  providers; 

19  (C)  whether  the  services  furnished  by  such 

20  health  care  providers  are  appropriate  for  or 

21  would  benefit  from  the  use  of  such  systems; 

22  (D)  the  extent  to  which  such  health  care 

23  providers  work  in  settings  that  might  otherwise 

24  receive  an  incentive  payment  or  other  funding 
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1  under  this  Act,  title  XVIII  or  XIX  of  the  Social 

2  Security  Act,  or  otherwise; 

3  (E)  the  potential  costs  and  the  potential 

4  benefits   of  making  payment  incentives  and 

5  other  funding-  available  to  such  health  care  pro- 

6  viders;  and 

7  (F)  any  other  issues  the  Comptroller  Gen- 

8  eral  deems  to  be  appropriate. 

9  (2)  Report.— Not  later  than  June  30,  2010, 

10  the  Comptroller  General  shall  submit  to  Congress  a 

11  report  on  the  findings  and  conclusions  of  the  study 

12  conducted  under  paragraph  (1). 

13  SEC.  302.  INCENTIVES  FOR  HOSPITALS. 

14  (a)  Incentive  Payment. — Section  1886  of  the  So- 

15  cial  Security  Act  (42  U.S.C.  1395ww)  is  amended  by  add- 

16  ing  at  the  end  the  following  new  subsection: 

17  "(o)  Incentives  for  Adoption  and  Meaningful 

18  Use  of  Certified  Health  Information  Technology 

19  Systems. — 

20  "(1)  In  general. — Subject  to  the  succeeding 

21  provisions  of  this  subsection,  with  respect  to  inpa- 

22  tient  hospital  services  furnished  by  an  eligible  hos- 

23  pital  during  the  first  fiscal  year  beginning  after  the 

24  date  specified  in  paragraph  (6)  (or,  if  sooner,  fiscal 

25  year  2013)  or  any  subsequent  fiscal  year  (before  fis- 
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1  cal  year  2017),  if  the  eligible  hospital  is  a  meaning- 

2  ful  HIT  user  for  the  fiscal  year  (as  determined 

3  under  paragraph  (3)),  in  addition  to  the  amount 

4  otherwise  paid  under  this  section,  there  also  shall  be 

5  paid  to  the  eligible  hospital,  from  the  Federal  Hos- 

6  pital  Insurance  Trust  Fund  established  under  sec- 

7  tion   1817,   an   amount   equal   to   the  applicable 

8  amount  specified  in  paragraph  (2) (A)  for  such  fiscal 

9  year. 

10  "(2)  Payment  amount. — 

11  "(A)  In  general. — Subject  to  subpara- 

12  graph  (F),  the  applicable  amount  specified  in 

13  this  subparagraph  for  an  eligible  hospital  for  a 

14  fiscal  year  is  equal  to  the  product  of  the  fol- 

15  lowing: 

16  "(i)  Initial  amount.— The  sum  of — 

17  "(I)  the  base  amount  specified  in 

18  subparagraph  (B);  plus 

19  "(11)     the     discharge  related 

20  amount  specified  in  subparagraph  (C) 

21  for  a  period  selected  by  the  Secretary 

22  with  respect  to  such  fiscal  year. 

23  "(ii)  Medicare  share.— The  Medi- 

24  care  share  as  specified  in  subparagraph 

25  (D)  for  the  hospital  for  a  period  selected 
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1  by  the  Secretaiy  with  respect  to  such  fiscal 

2  year. 

3  "(iii)     Transition     factor. — The 

4  transition  factor  specified  in  subparagraph 

5  (E)  for  the  fiscal  year. 

6  "(B)  Base  amount. — The  base  amount 

7  specified  in  this  subparagraph  is  $1,000,000. 

8  "(C)  Discharge  related  amount. — The 

9  discharge  related  amount  specified  in  this  sub- 

10  paragraph  for  a  period  shall  be  determined  as 

11  the  sum  of  the  amount,  based  upon  total  dis- 

12  charges  (regardless  of  any  source  of  payment) 

13  for  the  period,  for  each  discharge  up  to  the 

14  13,800th  discharge  as  follows: 

15  "(i)   For   the   1150th   through  the 

16  9,200nd  discharge,  $200. 

17  "(h)   For  the   9,201st  through  the 

18  13,800th  discharge,   50   percent  of  the 

19  amount  specified  in  clause  (i). 

20  "(D)  Medicare  share. — The  Medicare 

21  share  specified  under  this  subparagraph  for  a 

22  hospital  for  a  period  is  equal  to  the  fraction — 

23  "(i)  the  numerator  of  which  is  the 

24  sum  (for  the  period  and  with  respect  to  the 

25  hospital)  of — 
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1  "(I)  the  number  of  inpatient-bed- 

2  days  (as  established  by  the  Secretary) 

3  which  are  attributable  to  individuals 

4  with  respect  to  whom  payment  may  be 

5  made  under  part  A;  and 

6  "(H)  the  number  of  inpatient- 

7  bed-days  (as  so  established)  which  are 

8  attributable  to  individuals  who  are  en- 

9  rolled  under  a  risk-sharing  contract 

10  with  an  eligible  organization  under 

11  section  1876  and  who  are  entitled  to 

12  part  A  or  with  a  Medicare  Advantage 

13  organization  under  part  C;  and 

14  "(ii)  the  denominator  of  which  is  the 

15  product  of — 

16  "(I)  the  total  number  of  inpa- 

17  tient-bed-days  with  respect  to  the  hos- 

1 8  pital  during  the  period;  and 

19  "(11)  the  total  amount  of  the  hos- 

20  pital' s  charges  during  the  period,  not 

21  including  any  charges  that  are  attrib- 

22  utable  to  charity  care  (as  such  term  is 

23  used  for  purposes  of  hospital  cost  re- 

24  porting  under  this  title),  divided  by 
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1  the  total  amount  of  the  hospital's 

2  charges  during  the  period. 

3  "(E)  Transition  factor  specified. — 

4  The  transition  factor  specified  in  this  subpara- 

5  graph  is  as  follows: 

6  "(i)  For  the  first  fiscal  year  beginning 

7  after  the  date  specified  in  paragraph  (6) 

8  (or,  of  sooner,  fiscal  year  2013),  1. 

9  "(ii)  For  the  fiscal  year  following  the 

10  fiscal  year  specified  in  clause  (i), 

11  "(iii)  For  the  fiscal  year  follomng  the 

12  fiscal  year  specified  in  clause  (ii),  V2. 

13  "(iv)  For  the  fiscal  year  following  the 

14  fiscal  year  specified  in  clause  (iii),  V4. 

15  "(F)  Limitations. — 

16  "(i)  Pro-ration  for  pajrtial  year 

17  HOSPITALS. — In  the  case  of  an  eligible  hos- 

18  pital  that  is  a  meaningfal  HIT  user  for 

19  only  a  portion  of  a  fiscal  year  for  reasons 

20  such  as  the  hospital  did  not  provide  serv- 

21  ices  for  which  payment  is  made  under  this 

22  section  for  a  portion  of  the  fiscal  year  or 

23  the  hospital  changed  the  use  of  health  in- 

24  formation   technology   during   the  fiscal 

25  year,  the  Secretary  may  pro-rate  the  appli- 
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1  cable  amount  specified  under  subparagraph 

2  (A)  to  reflect  the  portion  of  the  fiscal  year 

3  during  which  the  hospital  was  a  meaning- 

4  ful  HIT  user. 

5  "(ii)  Form  of  payment. — The  pay- 

6  ment  under  this  subsection  for  a  fiscal 

7  year  may  be  in  the  form  of  a  single  con- 

8  solidated  payment  or  in  the  form  of  such 

9  periodic  installments  as  the  Secretary  may 

10  specify. 

11  There  shall  be  no  incentive  payment  under  this 

12  subsection,  or  payment  adjustment  under  sub- 

13  section  (b)(3)(B)(ix),  for  a  fiscal  year  in  the 

14  case  of  an  eligible  hospital  for  which  the  sum  of 

15  the  inpatient-bed  days  described  in  subclauses 

16  (I)  and  (II)  of  subparagraph  (D)(i),  for  a  pe- 

17  riod  specified  by  the  Secretary  with  respect  to 

18  such  fiscal  year,  is  an  amount  that  is  less  than 

19  1,000. 

20  "(3)  Meaningful  hit  user. — 

21  "(A)  In  general. — For  purposes  of  para- 

22  graph  (1),  an  eligible  hospital  shall  be  treated 

23  as  a  meaningful  HIT  user  for  a  fiscal  year  if 

24  the  eligible  hospital  demonstrates  to  the  satis- 

25  faction  of  the  Secretary  that  the  hospital  is 
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1  meaningfully  using  a  certified  health  informa- 

2  tion  technology  system  with  respect  to  such  fis- 

3  cal  year,  as  demonstrated  in  accordance  with 

4  applicable  measures  established  under  subpara- 

5  graph  (B). 

6  "(B)     Standards    for  meaningful 

7  USE. — The  Secretary  shall  establish  measures 

8  under  which  an  eligible  hospital  may  dem- 

9  onstrate  meaningful  use  of  a  certified  health  in- 

10  formation  technology  system  for  a  fiscal  year. 

1 1  Such  measures  may  include — 

12  "(i)    self-certification   of  operational 

13  use  of  such  a  system; 

14  "(ii)  the  submission  (or  ability  to  sub- 

15  mit),  in  a  form  and  manner  specified  by 

16  the  Secretary  (which  may  include  the  man- 

17  ner    used    for    purposes    of  subsection 

18  (b)(3)(B)(viii)),   of  such  information  on 

19  clinical  measures  and  data  (that  does  not 

20  include  individually  identifiable  health  in- 

21  formation)  from  such  system  that  indicates 

22  a  meaningful  utilization  of  such  a  system 

23  during  the  year;  and 

24  "(iii)  such  other  means  as  the  Sec- 

25  retary  may  specify. 
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1  The  Secretary  may  establish  and  apply  different 

2  measures  based  on  the  stage  of  implementation 

3  or  adoption  of  the  certified  health  information 

4  technology  system  involved  or  based  on  the 

5  characteristics  (such  as  size)  of  the  hospital. 

6  "(C)  Authority  to  revise  measures. — 

7  The  Secretary  may  periodically  revise  the  meas- 

8  ures  established  under  subparagraph  (B)  with 

9  respect  to  demonstrating  meaningful  use  of  a 

10  certified  health  information  technology  system. 

11  "(4)  Application. — 

12  "(A)  Limitations  on  review. — There 

13  shall  be  no  administrative  or  judicial  review 

14  under  1869,  section  1878,  or  otherwise  of — 

15  "(i)  the  determination  of  measures 

16  applicable  to  services  furnished  by  eligible 

17  hospitals  under  this  subsection; 

18  "(ii)  the  determination  of  a  meaning- 

19  ful  HIT  user  under  paragraph  (3) (A)  and 

20  the       exception       under  subsection 

21  (b)(3)(B)(ix)(III);  and 

22  "(iii)  the  determination  of  any  incen- 

23  tive  payment  under  this  subsection  and  the 

24  payment    adjustment    under  subsection 

25  (b)(3)(B)(ix). 
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1  "(B)  Posting  on  website. — The  Sec- 

2  retary  shall  post  on  the  Internet  website  of  the 

3  Centers  for  Medicare  &  Medicaid  Services,  in  an 

4  easily  understandable  format,   a  list  of  the 

5  names  of  the  eligible  hospitals  that  are  mean- 

6  ingful  HIT  users  and  other  relevant  data  as  de- 

7  termined  appropriate  by  the  Secretary.  The 

8  Secretary  shall  ensure  that  a  hospital  has  the 

9  opportunity  to  review  the  other  relevant  data 

10  that  are  to  be  made  public  with  respect  to  the 

11  hospital  prior  to  such  data  being  made  public. 

12  "(5)   Application   to   certain   ma  hos- 

13  PITALS. — Notwithstanding  section  1851  (i)(l),  an  eli- 

14  gible  hospital  that  is  under  common  corporate  gov- 

15  ernance  with  a  qualifying  MA  organization  (as  de- 

16  fined  in  section  1853(1) (5))  and  that  serves  individ- 

17  uals  enrolled  under  a  plan  offered  by  such  organiza- 

18  tion  shall  be  eligible  for  an  incentive  payment  under 

19  this  subsection  in  the  same  manner  as  an  eligible 

20  hospital  that  is  not  under  such  common  corporate 

21  governance  with  a  qualifying  MA  organization. 

22  "(6)  Date  specked. — The  date  specified  in 

23  this  paragraph  is  the  date  on  which  the  open  source 

24  health  information  technology  system  under  section 
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1  3001(e)(4)  of  the  Public  Health  Service  Act  is  first 

2  made  publicly  available. 

3  "(7)  Definitions. — For  purposes  of  this  sub- 

4  section  and  subsection  (b)(3)(B)(ix): 

5  "(A)  Certified  health  information 

6  technology   system. — The   term  'certified 

7  health  information  technology  system'  means, 

8  with  respect  to  an  eligible  hospital  and  a  fiscal 

9  year,  a  health  information  technology  system 

10  (as  defined  in  section  3000  of  the  Public  Health 

11  Service  Act)  that  has  a  current  certification 

12  under  section  3001(c)(3)  of  such  Act  as  satis- 

13  fying  all  interoperability  standards,  privacy  and 

14  security  standards,   and  clinical  and  quality 

15  functions  adopted  under  section  3003(a)  of 

16  such  Act  as  of  a  date  specified  by  the  Secretary 

17  with  respect  to  such  fiscal  year  that  are  applica- 

18  ble  to  the  eligible  hospital. 

19  "(B)  Eligible  hospital. — The  term  'eh- 

20  gible  hospital'  means  a  subsection  (d)  hos- 

21  pital.". 

22  (b)  Incentive  Market  Basket  Adjustment. — 


23  Section  1886(b)(3)(B)  of  the  Social  Security  Act  (42 

24  U.S.C.  1395ww(b)(3)(B))  is  amended— 


'HR  6898  IH 


67 

1  (1)  in  clause  (viii)(I),  by  inserting  "(or,  begin- 

2  ning  with  fiscal  year  2016,  by  one-half)"  after  "2.0 

3  percentage  points";  and 

4  (2)  by  adding  at  the  end  the  following  new 

5  clause: 

6  "(ix)(I)  Subject  to  the  third  sentence  of  subsection 

7  (o)(2)(F),  for  purposes  of  clause  (i)  for  fiscal  year  2016 

8  and  each  subsequent  fiscal  year,  in  the  case  of  a  sub- 

9  section  (d)  hospital  that  is  not  a  meaningful  HIT  user  (as 

10  defined  in  subsection  (o)(3))  with  respect  to  such  fiscal 

1 1  year,  one-half  of  the  applicable  percentage  increase  other- 

12  wise  applicable  under  clause  (i)  for  such  fiscal  year  shall 

13  be  reduced  by  25  percent  for  fiscal  year  2016,  50  percent 

14  for  fiscal  year  2017,  75  percent  for  fiscal  year  2018,  and 

15  100  percent  for  fiscal  year  2019  and  each  subsequent  fis- 

16  cal  year.  Such  reduction  shall  apply  only  with  respect  to 

17  the  fiscal  year  involved  and  the  Secretary  shall  not  take 

18  into  account  such  reduction  in  computing  the  applicable 

19  percentage  increase  under  clause  (i)  for  a  subsequent  fis- 

20  cal  year. 

21  "(11)  The  Secretary  may,  on  a  case-by-case  basis,  ex- 

22  empt  a  subsection  (d)  hospital  from  the  application  of  sub- 

23  clause  (I)  with  respect  to  a  fiscal  year  if  the  Secretary 

24  determines,  subject  to  annual  renewal,  that  requiring  such 

25  hospital  to  be  a  meaningful  HIT  user  during  such  fiscal 
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1  year  would  result  in  a  significant  hardship,  such  as  in  the 

2  case  of  a  hospital  in  a  rural  area  without  sufficient  Inter- 

3  net  access.  In  no  case  may  a  hospital  be  granted  an  ex- 

4  emption  under  this  subclause  for  more  than  5  years.". 

5  (c)  Conforming  Amendment. — Section  1851(i)(l) 

6  of  such  Act  (42  U.S.C.  1395w-21(i)(l))  is  amended  by 

7  striking-      "and       1886(h)(3)(D)"       and  inserting 

8  "1886(h)(3)(D),  and  1886(o)(6)". 


9 

(d)  GAO  Study  and  Report. — 

10 

(1)  Study. — The  Comptroller  General  of  the 

11 

United  States  shall  conduct  a  study  to  determine  the 

12 

extent  to  which  and  manner  in  which  payment  in- 

13 

centives  (such  as  under  title  XVIII  or  XIX  of  the 

14 

Social  Security  Act)  and  other  funding  for  purposes 

15 

of  implementing  and  using  health  information  tech- 

16 

nology  should  be  made  available  to  health  care  set- 

17 

tings  that  are  receiving  minimal  or  no  payments  or 

18 

other  funding  under  this  Act,  title  XVIII  or  XEK  of 

19 

the  Social  Security  Act,  or  otherwise,  for  such  pur- 

20 

poses.  Such  health  care  settings  may  include  skilled 

21 

nursing  facilities,  home  health  agencies,  hospice  pro- 

22 

grams,  laboratories,  federally  qualified  health  cen- 

23 

ters,  and  pediatric  hospitals.  Such  study  shall  in- 

24 

clude  an  examination  of — 
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1  (A)  the  adoption  rates  of  certified  health 

2  information  technology  systems  at  such  set- 

3  tings; 

4  (B)  the  clinical  utility  of  such  systems  at 

5  such  settings; 

6  (C)  whether  the  services  furnished  at  such 

7  settings  are  appropriate  for  or  would  benefit 

8  from  the  use  of  such  systems; 

9  (D)  the  potential  costs  and  the  potential 

10  benefits  of  providing  such  settings  Avith  incen- 

1 1  tive  pajTuents  and  other  funding  for  such  pur- 

12  poses;  and 

13  (E)  any  other  issues  the  Comptroller  Gen- 

14  eral  deems  to  be  appropriate. 

15  (2)  Report.— Not  later  than  June  30,  2010, 

16  the  Comptroller  General  shall  submit  to  Congress  a 

17  report  on  the  findings  and  conclusions  of  the  study 

18  conducted  under  paragraph  (1). 

19  SEC.  303.  INCENTIVES  FOR  CERTAIN  MEDICARE  ADVAN- 

20  TAGE  PLANS. 

21  (a)  In  GeneraIj. — Section  1853  of  the  Social  Secu- 

22  rity  Act  (42  II.S.C.  1395w-23)  is  amended— 

23  (1)  in  subsection  (a)(1)(A),  by  striking  "and 

24  (i)"  and  inserting  "(i),  and  (1)";  and 
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1  (2)  by  adding  at  the  end  the  following  new  sub- 

2  sections: 

3  "(1)  Application  of  Eligible  Professional  In- 

4  CENTIVES  FOR  CERTAIN  MA  ORGANIZATIONS  TO  IMPLE- 

5  MENT  Certified  Health  Information  Technology 

6  Systems. — 

7  "(1)  In  general. — Subject  to  paragraphs  (3) 

8  and  (4),  in  the  case  of  a  qualifying  MA  organization, 

9  the  provisions  of  sections  1848(o)  and  1848(a)(7) 
10  shall  apply  with  respect  to  eligible  professionals  de- 
ll scribed  in  paragraph  (2)  of  the  organization  who  the 

12  organization  attests  under  section  1854(a)(1)(A) (iv) 

13  to  be  meaningful  HIT  users  under  in  a  similar  man- 

14  ner  as  they  apply  to  eligible  professionals  in  a  group 

15  practice  under  such  sections. 

16  "(2)  Eligible  professionals  described. — 

17  With  respect  to  a  qualifying  MA  organization,  eligi- 

18  ble  professionals  described  in  this  paragraph  are  eli- 

19  gible  professionals  (as  defined  for  purposes  of  sec- 

20  tion  1848(o))  who— 

21  ^'(A)  are  employed  by  the  organization  or 

22  are  employed  by  or  partners  of  an  entity  that, 

23  through  contract  with  the  organization,  pro- 

24  vides  its  services  predominantly  or  exclusively  to 

25  enrollees  of  such  organization;  and 
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1  "(B)  furnish,  on  average,  at  least  20  hours 

2  per  week  of  professional  services. 

3  "(3)  Incentive  payments. — In  applying  sec- 

4  tion  1848(o)  under  paragraph  (1),  instead  of  the  ad- 

5  ditional  payment  amount  under  subparagraph  (A)  of 

6  section  1848(o)(l),  there  shall  be  substituted  the 

7  maximum  amount  permitted  under  such  section  mul- 

8  tiplied  by  the  medicare  share  (as  determined  by  the 

9  Secretary).  Such  medicare  share  for  an  organization 

10  shall  be  determined  in  a  manner  so  as  to  result  in 

11  the  same  aggregate  payments  to  the  organization  as 

12  would  be  paid  under  section  1848(o)  to  the  eligible 

13  professionals  described  in  paragraph  (2) (A)  for  serv- 

14  ices  furnished  under  part  B  of  this  title. 

15  "(4)  Payment  adjustment. — 

16  "(A)  In  general. — In  appljdng  section 

17  1848(a)(7)  under  paragraph  (1),  instead  of  the 

18  payment  adjustment  being  an  applicable  per- 

19  cent  of  the  fee  schedule  amount  for  a  year 

20  under  such  section,  the  payment  adjustment 

21  under  paragraph  (1)  shall  be  equal  to  the  per- 

22  cent  specified  in  subparagraph  (B)  for  such 

23  year  of  the  payment  amount  otherwise  provided 

24  under  this  section  for  the  year. 
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1  "(B)  Specified  percent. — The  percent 

2  specified  under  this  subparagraph  for — 

3  "(i)  2016  is  99.6  percent; 

4  "(ii)  2017  is  99.2  percent; 

5  "(iii)  2018  is  98.8  percent;  and 

6  "(iv)  2019  and  each  subsequent  year 

7  is  98.4  percent. 

8  "(5)    Qualifying    ma   organization  de- 

9  FINED. — In  this  subsection  and  subsection  (m),  the 

10  term  'quahfying  MA  organization'  means  an  organi- 

11  zation  that  is  organized  as  a  health  maintenance  or- 

12  ganization  (as  defined  in  section  2791(b)(3)  of  the 

13  Public  Health  Service  Act)  that  offers  one  or  more 

14  MA  plans  under  which  the  physicians  furnishing 

15  physicians'  services  under  such  a  plan  are  predomi- 

16  nantly  either  employees  of  the  organization  or  are 

17  employees  or  partners  of  an  entity  that,  through 

18  contract  with  the  organization,  provides  its  services 

19  predommantly  or  exclusively  to  enroUees  of  such  or- 

20  ganization. 

21  "(m)  Eligible  Hospital  Incentives  for  Cer- 

22  TAIN  MA  Organizations  To  Implement  Certified 

23  Health  Information  Technology  Systems. — 

24  "(1)  In  general. — Subject  to  paragraph  (3), 

25  in  the  case  of  a  qualifying  MA  organization  (as  de- 
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1  fined  in  section  1853(1)  (5)),  if,  according  to  the  at- 

2  testation  of  the  organization  submitted  under  section 

3  1854(a)(1)  (A) (iv)  for  a  year,  one  or  more  ehgible 

4  hospitals  (as  defined  in  section  1886(o)(7)(B))  that 

5  are  under  common  corporate  governance  with  such 

6  organization  and  that   serve  individuals  enrolled 

7  under  a  plan  offered  by  such  organization  are  not 

8  meaningful    HIT    users    (as    defined    in  section 

9  1886(o)(3)  with  respect  to  a  year,  the  payment 

10  amount  payable  under  this  section  for  such  organi- 

1 1  zation  for  such  year  shall  be — 

12  "(A)  reduced  by  a  percent  specified  by  the 

13  Secretary  for  such  year;  or 

14  "(B)  in  the  case  the  Secretary  is  not  able 

15  to  specify  reductions  under  subparagraph  (A) 

16  because  of  insufficient  encounter  data  or  other 

17  appropriate  date,  the  amount  that  is  equal  to 

18  the  percent  specified  under  paragraph  (2)  of 

19  the  payment  amount  otherwise  provided  under 

20  this  section  to  the  organization  for  the  year. 

21  Reductions  specified  by  the  Secretary  under  sub- 

22  paragraph  (A)  shall  be  determined  in  a  manner  so 

23  as  to  result  in  the  same  aggregate  reductions  to  the 

24  organization  as  would  be  applied  under  section 

25  1886(b)(3)(B)(ix)  to  all  such  eligible  hospitals  under 
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1  common  corporate  governance  with  such  organiza- 

2  tion  if  payment  for  inpatient  services  furnished  by 

3  such  hospitals  was  payable  under  part  A  instead  of 

4  this  part. 

5  "(2)  Alternative  percent  specified. — The 

6  percent  specified  under  this  paragraph  for — 

7  "(A)  2016  is  99.95  percent; 

8  "(B)  2017  is  99.90  percent; 

9  "(C)  2018  is  99.85  percent;  and 

10  "(D)  2019  and  each  subsequent  year  is 

11  99.80  percent. 

12  "(3)  Limitation. — In  no  case  may  the  applica- 

13  tion  of  subsection  (1)  and  this  subsection  with  re- 

14  spect  to  a  year  result  in  a  payment  amount  payable 

15  under  this  section  for  a  qualifying  MA  organization 

16  for  the  year  that  is  less  than  the  amount  that  is 

17  equal  to  the  percent  specified  under  paragraph  (4) 

18  of  the  payment  amount  that  would  otherwise  be  pro- 

19  vided  under  this  section  to  the  organization  for  the 

20  year  without  regard  to  subsection  (1)  and  this  sub- 

21  section. 

22  "(4)  Specified  percent. — The  percent  speci- 

23  fied  under  this  paragraph  for — 

24  "(A)  2016  is  99  percent; 

25  "(B)  2017  is  98  percent; 
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1  ''(C)  2018  is  97  percent;  and 

2  "(D)  2019  and  each  subsequent  year  is  96 

3  percent.". 

4  (b)  Meaningful  HIT  User  Attestation  With 

5  Bids. — Section  1854(a)(1)(A)  of  the  Social  Security  Act 

6  (42  U.S.C.  1395w-24(a)(l)(A))  is  amended  by  adding  at 

7  the  end  the  following  new  clause: 

8  "(iv)  An  attestation  identifying  wheth- 

9  er  each  eligible  professional  described  in  ■  - 

10  section  1853(1)  (2)  with  respect  to  such  or- 

11  ganization  is  a  meaningful  HIT  user  (as 

12  defined  in  section  1848(o)(3))  for  the  year 

13  and  whether  each   eligible   hospital  de- 

14  scribed  in  section  1853(m)(l),  with  respect 

15  to  such  organization,  is  a  meaningful  HIT 

16  user  (as  defined  in  section  1886(o)(3))  for 

17  the  year.". 

18  (c)  HIT  Incentrhe  Payments  Exempt  From 

19  Benchmark  Determinations. — Section  1853(c)  of  the 

20  Social  Security  Act  (42  U.S.C.  1395w-23(c))  is  amend- 

21  ed— 

22  (1)  in  paragraph  (l)(D)(i),  by  striking  "section 

23  1886(h)"  and  inserting  "sections  1848(o),  1886(h), 

24  and  1886(o)";  and 
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1  (2)  in  paragraph  (6) (A),  by  inserting  after 

2  "under  part  B,"  the  following:  "excluding  expendi- 

3  tures  attributable  to  sections  1848(o)  and  1886(o)". 

4  (d)  Conforming  Amendment. — Section  1853(f)  of 

5  such  Act  (42  U.S.C.  1395w-23(f))  is  amended  by  insert- 

6  ing  "and  for  payments  under  subsection  (1)"  after  "with 

7  the  organization". 

8  Subtitle   B — Other   Incentives  for 

9  the  Implementation  and  Use  of 

10  Health  Information  Technology 

1 1  SEC.  311.  GRANT,  LOAN,  AND  DEMONSTRATION  PROGRAMS. 

12  Title  XXX  of  the  Public  Health  Service  Act,  as  added 

13  by  section  101,  is  amended  by  adding  at  the  end  the  fol- 

14  lowing  new  subtitle: 

15  "Subtitle  B — Incentives  for  the  Use 

16  of  Health  Information  Technology 

17  "SEC.  3011.  GRANTS  AND  LOANS  TO  FACILITATE  THE  WIDE- 

18  SPREAD  ADOPTION  OF  QUALIFIED  HEALTH 

19  INFORMATION  TECHNOLOGY. 

20  "(a)  Competitive  Grants  To  Facilitate  the 

21  Widespread  Adoption  of  Health  Information 

22  Technology. — 

23  "(1)  In  GENERAL. — The  National  Coordinator 

24  may  award  competitive  grants  to  eligible  entities  to 

25  purchase  qualified  health  information  technology. 
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1  "(2)  Qualified  health  information  tech- 

2  NOLOGY. — For  purposes  of  this  section,  the  term 

3  'quahfied   health    information   technology'  means 

4  health  information  technology  that  consists  of  hard- 

5  ware,  software,  or  the  provision  of  support  services 

6  and  that — 

7  "(A)  enables  the  protection  of  health  infor- 

8  mation,  in  accordance  with  applicable  law; 

9  "(B)  is  (or  is  necessary  for  the  operation 

10  of)  an  electronic  health  records  system,  includ- 

1 1  ing  the  provision  of  decision  support  and  physi- 

12  cian  order  entry  for  medications; 

13  "(C)  has  the  ability  to  allow  timely  and 

14  permissible  access  to  patient  information  and  to 

15  transmit    and    exchange    health  information 

16  among  providers,  patients,  or  insurers;  and 

17  "(D)  is  certified  under  the  program  devel- 

18  oped  under  section  3001(c)(3)  to  be  in  comph- 

19  ance  with  any  applicable  standards  adopted 

20  under  section  3003(a). 

21  "(3)  Eligibility. — To  be  ehgible  to  receive  a 

22  grant  under  paragi'aph  (1)  an  entity  shall — 

23  "(A)  submit  to  the  National  Coordinator 

24  an  application  at  such  time  and  in  such  manner 
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1  as  the  National  Coordinator  may  require,  and 

2  containing — 

3  "(i)  a  plan  on  how  the  entity  intends 

4  to   maintain   and   support   the  qualified 

5  health  information  technology  that  would 

6  be  purchased  with  amounts  under  such 

7  grant,  including  the  type  of  resources  ex- 

8  pected  to  be  involved;  and 

9  "(ii)  such  other  information  as  the 

10  National  Coordinator  may  require; 

11  "(B)  submit  to  the  National  Coordinator  a 

12  plan  for  how  qualified  health  information  tech- 

13  nology  purchased  by  the  entity  will  result  in  the 

14  electronic  exchange  and  use  of  health  informa- 

15  tion; 

16  "(C)  be— 

17  "(i)  a  not  for  profit  hospital  or  a  Fed- 

18  erally  qualified  health  center  (as  defined  in 

19  section  1861(aa)(4)  of  the  Social  Security 

20  Act); 

21  "(ii)  an  individual  or  group  practice; 

22  or 

23  "(iii)   another  health  care  provider, 

24  such  as  a  rural  health  clinic,  not  described 

25  in  clause  (i)  or  (ii); 
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1  "(D)    demonstrate    significant  financial 

2  need; 

3  "(E)  agree  to  notify  individuals  in  accord- 

4  ance  with  section  402  of  the  Health-e  Informa- 

5  tion  Technology  Act  of  2008  (relating  to  notifi- 

6  cations  in  the  case  of  breaches); 

7  "(F)  provide  matching  funds  in  accordance 

8  with  paragraph  (5); 

9  "(Gr)  consult  with  the  Health  Information 

10  Technology  Resource  Center  established  under 

11  section  3006  to  access  the  knowledge  and  expe- 

12  rience  of  existing  initiatives  regarding  the  suc- 

13  cessfiil  implementation  and  effective  use  of 

14  health  information  technology;  and 

15  "(H)  link,  to  the  extent  practicable,  to  one 

16  or  more  local  or  regional  health  information 

17  plans. 

18  "(4)  Use  of  funds. — ^Amounts  received  under 

19  a  grant  under  this  subsection  shall  be  used  to  facili- 

20  tate  the  purchase  of  qualified  health  information 

21  technology. 

22  "(5)  Matching  requirement. — To  be  eligible 

23  for  a  grant  under  this  subsection  an  entity  shall  eon- 

24  tribute  non-Federal  contributions  to  the  costs  of  car-- 

25  lying  out  the  activities  for  which  the  gi-aiit  is  award- 
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1  ed  in  an  amount  equal  to  $1  for  each  $3  of  Federal 

2  funds  provided  under  the  grant. 

3  "(6)  Preference  in  awarding  grants. — 

4  "(A)  In  general. — In  awarding  grants 

5  under  this  subsection  the  National  Coordinator 

6  shall  give  preference  to  the  following  eligible  en- 

7  tities: 

8  "(i)  Small  health  care  providers. 

9  "(ii)  Entities  that  are  located  in  rural 

10  and  other   areas  that   serve  uninsured, 

11  underinsured,  and  medically  underserved 

12  individuals   (regardless  of  whether  such 

13  area  is  urban  or  rural). 

14  "(iii)  Nonprofit  health  care  providers. 

15  "(iv)  Health  care  providers  (such  as 

16  children's  hospitals,  pediatricians,  obstetri- 

17  cian-gynecologists,  and  hospitals  that  serve 

18  uninsured,  underinsured,  and  medically  un- 

19  derserved  individuals  and  that  have  limited 

20  Medicare  patient  loads)  that  have  not  re- 

21  ceived  any  funds,  or  have  received  a  mini- 

22  mal   amount   of  funds,   under  sections 

23  1848(o)  and  1886(o)  of  the  Social  Security 

24  Act. 
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1  "(B)      Consideration. — In  awarding 

2  grants  to  entities  under  this  subsection,  the  Na- 

3  tional  Coordinator  shall  take  into  account  the 

4  amount  of  funds  provided  to  such  entities  under 

5  other  laws,  including  under  sections  1848(o) 

6  and  1886(o)  of  the  Social  Security  Act. 

7  "(7)  Additional  sources  of  funding  for 

8  HEALTH      INFORMATION      TECHNOLOGY. — Funding 

9  made  available  under  this  subsection  is  in  addition 

10  to  funding  which  may  be  used  toward  the  acquisition 

11  and  utilization  of  health  information  technology 

12  under  other  law,  which  includes  the  following: 

13  "(A)     Medicaid    transformation  grants 

14  under  section  1903(z)  of  the  Social  Security 

15  Act. 

16  "(B)  Grants  or  funding  available  through 

17  the  Agency  for  Healthcare  Research  and  Qual- 

18  ity. 

19  "(C)  Grants  or  funding  that  may  be  avail- 

20  able  through  the  Health  Resources  and  Services 

21  Administration  for  investment  in  health  infor- 

22  mation  technologies  or  telehealth. 

23  "(D)  Grants  or  funding  that  may  be  avail- 

24  able  through  the  Department  of  Agriculture's 
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1  Rural  Development  Telecommunications  Pro- 

2  gram  for  investment  in  telemedicine. 

3  "(E)  Sections  1848(o)  and  1886(o)  of  the 

4  Social  Security  Act. 

5  "(b)  Competitive  Grants  to  States  and  Indian 

6  Tribes  for  the  Development  of  Loan  Programs  To 

7  Facilitate  the  Widespread  Adoption  of  Qualified 

8  Health  Information  Technology. — 

9  "(1)  In  general. — The  National  Coordinator 

10  may  award  competitive  grants  to  eligible  entities  for 

11  the  establishment  of  programs  for  loans  to  health 

12  care  providers  to  purchase  qualified  health  informa- 

13  tion  technology. 

14  "(2)  Eligible  entity  defined. — For  pur- 

15  poses  of  this  subsection,  the  term  'eligible  entity' 

16  means  a  State  or  Indian  tribe  (as  defined  in  the  In- 

17  dian  Self-Determination  and  Education  Assistance 

18  Act)  that— 

19  "(A)  submits  to  the  National  Coordinator 

20  an  application  at  such  time,  in  such  manner, 

21  and  containing  such  information  as  the  Na- 

22  tional  Coordinator  may  require; 

23  "(B)  submits  to  the  National  Coordinator 

24  a  strategic  plan  in  accordance  with  paragraph 

25  (4)  and  provides  to  the  National  Coordinator 
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1  assurances  that  the  entity  will  update  such  plan 

2  annually  in  accordance  with  such  paragraph; 

3  "(C)  provides  assurances  to  the  National 

4  Coordinator  that  the  entity  will  establish  a 

5  Loan  Fund  in  accordance  with  paragraph  (3); 

6  "(D)  provides  assurances  to  the  National 

7  Coordinator  that  the  entity  will  not  provide  a 

8  loan  from  the  Loan  Fund  to  a  health  care  pro- 

9  vider  unless  the  provider  meets  each  of  the  con- 

10  ditions  described  in  paragraph  (5);  and 

11  "(E)  agrees  to  provide  matching  funds  in 

12  accordance  with  paragraph  (9). 

13  "(3)  Establishment  of  fund. — For  purposes 

14  of  paragraph  (2)(C),  an  ehgible  entity  shall  estabhsh 

15  a  qualified  health  information  technology  loan  fund 

16  (referred  to  in  this  subsection  as  a  'Loan  Fund') 

17  and  comply  with  the  other  requirements  contained  in 

18  this  section.  A  grant  to  an  eligible  entity  under  this 

19  subsection  shall  be  deposited  in  the  Loan  Fund  es- 

20  tabhshed  by  the  eligible  entity.  No  funds  authorized 

21  by  other  provisions  of  this  subtitle  to  bo  used  for 

22  other  purposes  specified  in  this  subtitle  shall  be  de- 

23  posited  in  any  Loan  Fund. 

24  "(4)  STRATE(iI(;  PLAN. — 
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1  "(A)  In  generaIj. — For  purposes  of  para- 

2  graph  (2)(B),  a  strategic  plan  of  an  eligible  en- 

3  tity  under  this  paragraph  shall  identify  the  in- 

4  tended  uses  of  amounts  available  to  the  Loan 

5  Fund  of  such  entity. 

6  "(B)  Contents. — strategic  plan  under 

7  subparagraph  (A),  with  respect  to  a  Loan  Fund 

8  of  an  eligible  entity,  shall  include  for  a  year  the 

9  following: 

10  "(i)  A  list  of  the  projects  to  be  as- 

11  sisted  through  the  Loan  Fund  during  such 

12  year. 

13  "(ii)  A  description  of  the  criteria  and 

14  methods  established  for  the  distribution  of 

15  funds  from  the  Loan  Fund  during  the 

16  year. 

17  "(iii)  A  description  of  the  financial 

18  status  of  the  Loan  Fund  as  of  the  date  of 

19  submission  of  the  plan. 

20  "(iv)  The  short-term  and  long-term 

21  goals  of  the  Loan  Fund. 

22  "(5)  Health  care  provider  conditions  for 

23  RECEIPT  OF  LOANS. — For  purposes  of  paragraph 

24  (2)(D),  the  conditions  described  in  this  paragraph, 

25  with  respect  to  a  health  care  provider  that  seeks  a 
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1  loan  from  a  Loan  Fund  established  under  this  sub- 

2  section,  are  the  following: 

3  "(A)  The  health  care  provider  links,  to  the 

4  extent  practicable,  to  one  or  more  local  or  re- 

5  gional  health  information  networks. 

6  "(B)  The  health  care  provider  consults 

7  with  the  Health  Information  Technology  Re- 

8  source  Center  established  under  section  3006  to 

9  access  the  knowledge  and  experience  of  existing 

10  initiatives  regarding  the  successful  implementa- 

11  tion  and  effective  use  of  health  information 

12  technology. 

13  "(C)  The  health  care  provider  agrees  to 

14  notify  individuals  in  accordance  with  section 

15  402  of  the  Health-e  Information  Technology 

16  Act  of  2008  (relating  to  notifications  in  the 

17  case  of  breaches). 

18  "(D)  The  health  care  provider  submits  to 

19  the  State  or  Indian  tribe  involved  a  plan  on  how 

20  the  health  care  provider  intends  to  maintain 

21  and  support  the  qualified  health  information 

22  technology  that  would  be  purchased  with  such 

23  loan,  including  the  type  of  resources  expected  to 

24  be  involved  and  any  such  other  information  as 
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1  the  State  or  Indian  Tribe,  respectively,  may  re- 

2  quire. 

3  "(6)  Use  of  funds. — 

4  "(A)  In  general. — ^Amounts  deposited  in 

5  a  Loan  Fund,  including  loan  repayments  and 

6  interest  earned  on  such  amounts,  shall  be  used 

7  only  for  awarding  loans  or  loan  guarantees, 

8  making  reimbursements  described  in  paragraph 

9  (8) (D)(1),  or  as  a  source  of  reserve  and  security 

10  for  leveraged  loans,  the  proceeds  of  which  are 

11  deposited  in  the  Loan  Fund  established  under 

12  paragraph  (1).  Loans  under  this  section  may  be 

13  used  by  a  health  care  provider  to  purchase 

14  qualified  health  information  technology. 

15  "(B)  Limitation. — ^Amounts  received  by 

16  an  eligible  entity  under  this  subsection  may  not 

17  be  used — 

18  "(i)  for  the  purchase  or  other  acquisi- 

19  tion  of  any  health  information  technology 

20  system  that  is  not  a  qualified  health  infor- 

21  mation  technology;  or 

22  "(ii)  to  conduct  activities  for  which 

23  Federal  funds  are  expended  under  this 

24  title. 
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1  "(7)  Types  of  assistance. — Except  as  other- 

2  wise  limited  by  applicable  State  law,  amounts  depos- 

3  ited  into  a  Loan  Fund  under  this  subsection  may 

4  only  be  used  for  the  following: 

5  "(A)  To  award  loans  that  comply  with  the 

6  following: 

7  "(i)  The  interest  rate  for  each  loan 

8  shall  not  exceed  the  market  interest  rate. 

9  "(ii)  The  principal  and  interest  pay- 

10  ments  on  each  loan  shall  commence  not 

11  later  than  1  year  after  the  date  the  loan 

12  was  awarded,  and  each  loan  shall  be  fully 

13  amortized  not  later  than  10  years  after  the 

14  date  of  the  loan. 

15  "(iii)  The  Loan  Fund  shall  be  cred- 

16  ited  with  all  payments  of  principal  and  in- 

17  terest  on  each  loan  awarded  from  the  Loan 

18  Fund. 

19  "(B)  To  guarantee,  or  purchase  insurance 

20  for,  a  local  obligation  (all  of  the  proceeds  of 

21  which  finance  a  project  eligible  for  assistance 

22  under  this  subsection)  if  the  guarantee  or  pur- 

23  chase  would  improve  credit  market  access  or  re- 

24  duce  the  interest  rate  applicable  to  the  obliga- 

25  tion  involved. 
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1  "(C)  As  a  source  of  revenue  or  security  for 

2  the  pa3niient  of  principal  and  interest  on  rev- 

3  enue  or  general  obligation  bonds  issued  by  the 

4  eligible  entity  if  the  proceeds  of  the  sale  of  the 

5  bonds  will  be  deposited  into  the  Loan  Fund. 

6  "(D)  To  earn  interest  on  the  amounts  de- 

7  posited  into  the  Loan  Fund. 

8  "(E)  To  make  reimbursements  described  in 

9  paragraph  (8) (D)(1). 

10  "(8)  Administration  of  loan  funds. — 

11  "(A)  Combined  financial  administra- 

12  TION. — ^An  eligible  entity  may  (as  a  convenience 

13  and  to  avoid  unnecessary  administrative  costs) 

14  combine,  in  accordance  with  applicable  State 

15  law,  the  financial  administration  of  a  Loan 

16  Fund  established  under  this  subsection  with  the 

17  financial  administration  of  any  other  revolving 

18  fund  established  by  the  entity  if  otherwise  not 

19  prohibited  by  the  law  under  which  the  Loan 

20  Fund  was  established. 

21  "(B)  Cost  of  administering  fund. — 

22  Each  eligible  entity  may  annually  use  not  to  ex- 

23  ceed  4  percent  of  the  funds  provided  to  the  en- 

24  tity  under  a  grant  under  this  subsection  to  pay 

25  the  reasonable  costs  of  the  administration  of 
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1  the  programs  under  this  section,  including  the 

2  recovery  of  reasonable  costs  expended  to  estab- 

3  lish  a  Loan  Fund  which  are  incurred  after  the 

4  date  of  the  enactment  of  this  title. 

5  "(C)  Guidance  and  regulations. — The 

6  National  Coordinator  shall  publish  guidance 

7  and  promulgate  regulations  as  may  be  nec- 

8  essary  to  carry  out  the  provisions  of  this  sub- 

9  section,  including — 

10  "(i)  provisions  to  ensure  that  each  eli- 

11  gible  entity  commits  and  expends  funds  al- 

12  lotted  to  the  entity  under  this  subsection 

13  as  efficiently  as  possible  in  accordance  with 

14  this  title  and  applicable  State  laws;  and 

15  "(ii)  guidance  to  prevent  waste,  fraud, 

16  and  abuse. 

17  "(D)  Prr^ate  sector  contributions. — 

18  "(i)  In  general. — Loan  Fund  es- 

19  tabhshed  under  this  subsection  may  accept 

20  contributions  from  private  sector  entities, 

21  except  that  such  entities  may  not  specify 

22  the  recipient  or  recipients  of  any  loan 

23  issued  under  this  subsection.  An  eligible 

24  entity  may  agree  to  reimburse  a  private 

25  sector  entity  for  any  contribution  made 
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1  under  this  subparagraph,  except  that  the 

2  amount  of  such  reimbursement  may  not  be 

3  greater  than  the  principal  amount  of  the 

4  contribution  made. 

5  "(ii)    Availability    of  informa- 

6  TION. — ^An  ehgible  entity  shall  make  pub- 

7  licly  available  the  identity  of,  and  amount 

8  contributed  by,  any  private  sector  entity 

9  under  clause  (i)  and  may  issue  letters  of 

10  commendation  or  make  other  awards  (that 

1 1  have  no  financial  value)  to  any  such  entity. 

12  "(9)  Matching  REQUIREMENTS. — 

13  "(A)  In  general. — The  National  Coordi- 

14  nator  may  not  make  a  grant  under  paragraph 

15  (1)  to  an  eligible  entity  unless  the  entity  agrees 

16  to  make  available  (directly  or  through  donations 

17  from  public  or  private  entities)  non-Federal 

18  contributions  in  cash  to  the  costs  of  carrying 

19  out  the  activities  for  which  the  grant  is  awarded 

20  in  an  amount  equal  to  not  less  than  $1  for  each 

21  $1  of  Federal  funds  provided  under  the  grant. 

22  "(B)  Determination  of  amount  of 

23  non-federal  contribution. — In  determining 

24  the  amount  of  non-Federal  contributions  that 

25  an  eligible  entity  has  provided  pursuant  to  sub- 
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1  paragraph  (A),  the  National  Coordmator  may 

2  not  include  any  amounts  provided  to  the  entity 

3  by  the  Federal  Government. 

4  "(10)   Reports. — The   National  Coordinator 

5  shall  amiually  submit  to  the  Committee  on  Health, 

6  Education,  Labor,  and  Pensions  and  the  Committee 

7  on  Finance  of  the  Senate,  and  the  Committees  on 

8  Energy  and  Commerce  and  Ways  and  Means  of  the 

9  House  of  Representatives,  a  report  summarizing  the 

10  reports  received  by  the  National  Coordinator  from 

11  each  eligible  entity  that  receives  a  grant  under  this 

12  subsection. 

13  "(c)  Competitive  Grants  for  the  Implementa- 

14  TiON  OF  Regional  or  Local  Health  Information 

15  Technology  Plans. — 

16  "(1)  In  general. — The  National  Coordmator 

17  may  award  competitive  grants  to  ehgible  entities  to 

18  implement  regional  or  local  health  information  plans 

19  to  improve  health  care  quality  and  efficiency  through 

20  the  electronic  exchange  and  use  of  health  informa- 

21  tion. 

22  "(2)  Eligibility. — To  be  eligible  to  receive  a 

23  grant  under  paragraph  (1)  nu  entity  shall — 
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1  "(A)  facilitate  the  electronic  exchange  and 

2  use  of  health  information  within  the  local  or  re- 

3  gional  area  and  among  local  and  regional  areas; 

4  "(B)  demonstrate  financial  need  to  the  Na- 

5  tional  Coordinator; 

6  "(C)  demonstrate  that  one  of  its  principal 

7  missions  or  purposes  is  to  use  information  tech- 

8  nology  to  improve  health  care  quality  and  effi- 
9 .  ciency; 

10  ''(D)  adopt  bylaws,  memoranda  of  under- 

11  standing,  or  other  charter  documents  that  dem- 

12  onstrate  that  the  governance  structure  and  de- 

13  cisionmaking  processes  of  such  entity  allow  for 

14  participation  on  an  ongoing  basis  by  multiple 

15  stakeholders  within  a  community,  including — 

16  "(i)  physicians  (as  defined  in  section 

17  1861(r))  of  the  Social  Security  Act),  in- 

18  eluding  physicians  that  provide  services  to 

19  low  income  populations  and  populations 

20  that    are   uninsured,    underinsured,  and 

21  medically  underserved  (including  such  pop- 

22  ulations  in  urban  and  rural  areas); 

23  "(ii)  other  health  care  providers,  such 

24  as  hospitals  that  serve  uninsured,  under- 


•HR  6898  IH 


! 


93 

1  insured,  and  medically  underserved  individ- 

2  uals; 

3  "(iii)  patient  or  consumer  organiza- 

4  tions  that  reflect  the  population  to  be 

5  served; 

6  "(iv)  employers; 

7  ''(v)  public  health  agencies;  and 

8  ''(vi)  such  other  entities,  as  deter- 

9  mined  appropriate  by  the  National  Coordi- 

10  nator; 

11  "(E)  demonstrate  the  participation,  to  the 

12  extent  practicable,  of  stakeholders  in  the  elec- 

13  tronic  exchange  and  use  of  health  information 

14  within  the  local  or  regional  health  information 

15  plan  pursuant  to  subparagraph  (D); 

16  ''(F)  adopt  nondiscrimination  and  conflict 

17  of  interest  policies  that  demonstrate  a  commit- 

18  ment  to  open,  fair,  and  nondiscriminatory  par- 

19  ticipation  in  the  regional  or  local  health  infor- 

20  mation  plan  by  all  stakeholders; 

21  "(G)   comply  with   applicable  standards 

22  adopted  under  section  3003(a); 

23  "(H)  prepare  and  submit  to  the  National 

24  Coordinator  an  a[)plication  in  accordance  with 

25  paragraph  (3);  and 
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1  ^'(1)  agree  to  provide  matching  funds  in  ac- 

2  cordance  with  paragraph  (6). 

3  "(3)  Application. — 

4  "(A)  In  general. — To  be  ehgible  to  re- 

5  ceive  a  grant  under  paragraph  (1),  an  entity 

6  shall  submit  to  the  National  Coordinator  an  ap- 

7  plication  at  such  time,  in  such  manner,  and 

8  containing  such  information  (in  addition  to  in- 

9  formation  required  under  subparagraph  (B)),  as 

10  the  National  Coordinator  may  require. 

11  "(B)    Required    information. — ^At  a 

12  minimum,  an  application  submitted  under  this 

13  paragraph  shall  include — 

14  "(i)  clearly  identified  short-term  and 

15  long-term  objectives  of  the  regional  or  local 

16  health  information  plan; 

IT  "(ii)  an  estimate  of  costs  of  the  hard- 

18  ware,  software,  training,  and  other  services 

19  necessary  to  implement  the  regional  or 

20  local  health  information  plan; 

21  "(iii)  a  strategy  that  includes  initia- 

22  tives  to  improve  health  care  quality  and  ef- 

23  ficiency; 

24  "(iv)  a  plan  that  describes  provisions 

25  to  encourage  the  electronic  exchange  and 
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1  use  of  health  information  by  all  physicians, 

2  including  single  physician  practices  and 

3  small  physician  groups,  participating  in  the 

4  health  information  plan; 

5  "(v)  a  plan  to  ensure  the  privacy  and 

6  security  of  individually  identifiable  health 

7  information  that  is  consistent  with  applica- 

8  ble  Federal  and  State  law; 

9  "(vi)  a  governance  plan  that  defines 

10  the  manner  in  which  the  stakeholders  shall 

11  jointly  make  policy  and  operational  deci- 

12  sions  on  an  ongoing  basis; 

13  "(vii)  a  financial  or  business  plan  that 

14  describes — 

15  "(I)    the   sustainability   of  the 

16  plan; 

17  "(11)  the  financial  costs  and  ben- 

18  efits  of  the  plan;  and 

19  "(III)  the  entities  to  which  such 

20  costs  and  benefits  will  accrue; 

21  "(viii)  a  plan  on  how  the  entity  in- 

22  volved  intends  to  maintain  and  support  the 

23  regional  or  local  health  information  plan, 

24  including  the  type  of  resources  exi:)ected  to 

25  be  involved;  and 
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1  "(ix)  in  the  case  of  an  applicant  that 

2  is  unable  to  demonstrate  the  participation 

3  of  all  stakeholders  pursuant  to  paragraph 

4  (2)(D),  the  justification  from  the  entity  for 

5  any  such  nonparticipation. 

6  "(4)  Use  of  funds. — ^Amounts  received  under 

7  a  grant  under  paragraph  (1)  shall  be  used  to  estab- 

8  lish  and  implement  a  regional  or  local  health  infor- 

9  mation  plan  in  accordance  with  this  subsection. 

10  "(5)  Preference. — In  awarding  grants  under 

11  paragraph  (1),  the  Secretary  shall  give  preference  to 

12  eligible  entities  that  intend  to  use  amounts  received 

13  under  a  grant  to  establish  or  implement  a  regional 

14  or  local  health  information  plan  that  encompasses 

15  communities  with  health  disparities  or  areas  that 

16  serve  uninsured,  underinsured,  and  medically  under- 

17  served  individuals  (including  urban  and  rural  areas). 

18  "(6)  Matching  requirement. — 

19  "(A)  In  general. — The  National  Coordi- 

20  nator  may  not  make  a  grant  under  this  sub- 

21  section  to  an  entity  unless  the  entity  agrees 

22  that,  with  respect  to  the  costs  of  carrying  out 

23  the  activities  for  which  the  grant  is  awarded, 

24  the   entity  will   make   available   (directly  or 

25  through  donations  from  public  or  private  enti- 
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1  ties)   non-Federal   contributions   toward  such 

2  costs  in  an  amount  equal  to  not  less  than  50 

3  percent  of  such  costs  ($1  for  each  $2  of  Federal 

4  funds  provided  under  the  grant). 

5  "(B)  Determination  of  amount  con- 

6  tributed. — Non-Federal     contributions  re- 

7  quired  under  subparagraph  (A)  may  be  in  cash 

8  or  in  kind,  fairly  evaluated,  including  equip- 

9  ment,  technology,  or  services.  Amounts  provided 

10  by  the  Federal  Government,  or  services  assisted 

11  or  subsidized  to  any  significant  extent  by  the 

12  Federal  Government,  may  not  be  included  in 

13  determining  the  amount  of  such  non-Federal 

14  contributions. 

15  "(d)  Reports. — Not  later  than  1  year  after  the  date 


16  on  which  the  first  grant  is  awarded  under  this  section, 

17  and  annually  thereafter  during  the  grant  period,  an  entity 

18  that  receives  a  grant  under  this  section  shall  submit  to 

19  the  National  Coordinator  a  report  on  the  activities  carried 

20  out  under  the  grant  involved.  Each  such  report  shall  in- 

21  elude — 

22  "(1)  a  description  of  the  financial  costs  and 

23  benefits  of  the  project  involved  and  of  the  entities  to 

24  which  such  costs  and  benefits  accrue; 
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1  "(2)  an  analysis  of  the  impact  of  the  project  on 

2  health  care  quality  and  safety; 

3  "(3)  a  description  of  any  reduction  in  dupliea- 

4  tive  or  unnecessary  care  as  a  result  of  the  project  in- 

5  volved; 

6  "(4)  a  description  of  the  efforts  of  recipients 

7  under  this  section  to  facilitate  secure  patient  access 

8  to  health  information; 

9  ''(5)  an  analysis  of  the  effectiveness  of  the 

10  project  involved  on  ensuring  the  privacy  and  security 

11  of  individually  identifiable  health  information  in  ac- 

12  cordance  with  applicable  Federal  and  State  law;  and 

13  "(6)  other  information  as  required  by  the  Na- 

14  tional  Coordinator. 

15  "(e)  Requirement  To  Improve  Quality  of  Care 


16  AND  Decrease  in  Costs. — The  National  Coordinator 

17  shall  annually  evaluate  the  activities  conducted  under  this 

18  section  and  shall,  in  awarding  grants,  implement  the  les- 

19  sons  learned  from  such  evaluation  in  a  manner  so  that 

20  awards  made  subsequent  to  each  such  evaluation  are  made 

21  in  a  manner  that,  in  the  determination  of  the  National 

22  Coordinator,  will  result  in  the  greatest  improvement  in 

23  quality  of  care  and  decrease  in  costs.  ' 

24  "(f)  Limitation. — ^An  eligible  entity  may  only  receive 

25  one  non-renewable  grant  under  subsection  (a),  one  non- 
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1  renewable  grant  under  subsection  (b),  and  one  non-renew- 

2  able  grant  under  subsection  (e). 

3  "(g)  Small  Heai.th  Care  Provider. — For  pur- 

4  poses  of  this  section,  the  term  'small  health  care  provider' 

5  means  a  health  care  provider  that  has  an  average  of  10 

6  or  fewer  full-time  equivalent  employees  during  the  period 

7  involved. 

8  "(h)  Authorization  of  Appropriations. — 

9  "(1)  In  general. — For  the  purpose  of  car- 
lo lying  out  subsections  (a)  through  (d),  there  is  au- 

11  thorized  to  be  appropriated  $115,000,000  for  each 

12  of  the  fiscal  years  2009  through  2013. 

13  "(2)    Availability. — ^Amounts  appropriated 

14  under  paragraph  (1)  shall  remain  available  through 

15  fiscal  year  2013. 

16  "SEC.  3012.  DEMONSTRATION  PROGRAM  TO  INTEGRATE  IN- 

17  FORMATION   TECHNOLOGY  INTO  CLINICAL 

18  EDUCATION. 

19  "(a)  In  General. — The  Secretary  may  award  grants 

20  under  this  section  to  carry  out  demonstration  projects  to 

21  develop  academic  curricula  integrating  qualified  health  in- 

22  formation  technology  in  the  clinical  education  of  health 

23  professionals.  Such  awards  shall  be  made  on  a  competitive 

24  basis  and  pursuant  to  peer  review. 
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1  "(b)  Eligibility. — To  be  eligible  to  receive  a  grant 

2  under  subsection  (a),  an  entity  shall — 

3  "(1)  submit  to  the  Secretary  an  application  at 

4  such  time,  in  such  manner,  and  containing  such  in- 

5  formation  as  the  Secretary  may  require; 

6  "(2)  submit  to  the  Secretary  a  strategic  plan 

7  for  integrating  qualified  health  information  tech- 

8  nology  in  the  clinical  education  of  health  profes- 

9  sionals  to  reduce  medical  errors  and  enhance  health 

10  care  quality; 

11  "(3)  be- 
ll "(A)   a  school  of  medicine,  osteopathic 

13  medicine,  dentistry,  or  pharmacy,  a  graduate 

14  program  in  behavioral  or  mental  health,  or  any 

15  other  graduate  health  professions  school; 

16  "(B)  a  graduate  school  of  nursing  or  phy- 

17  sician  assistant  studies; 

18  "(C)  a  consortium  of  two  or  more  schools 

19  described  in  subparagraph  (A)  or  (B);  or 

20  "(D)  an  institution  with  a  graduate  med- 

21  ical  education  program  in  medicine,  osteopathic 

22  medicine,  dentistry,  pharmacy,  nursing,  or  phy- 

23  sician  assistance  studies; 

24  "(4)  provide  for  the  collection  of  data  regarding 

25  the  effectiveness  of  the  demonstration  project  to  be 
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1  funded  under  the  grant  in  improving  the  safety  of 

2  patients,  the  efficiency  of  health  care  dehvery,  and 

3  in  increasing  the  hkehhood  that  graduates  of  the 

4  grantee  will  adopt  and  incorporate  qualified  health 

5  information  technology,  in  the  delivery  of  health  care 

6  services;  and 

7  "(5)  provide  matching  funds  in  accordance  with 

8  subsection  (d). 

9  "(c)  Use  of  Funds. — 

10  "(1)  In  general. — ^With  respect  to  a  grant 

11  under  subsection  (a),  an  ehgible  entity  shall — 

12  ''(A)  use  grant  funds  in  collaboration  with 

13  2  or  more  disciplines;  and 

14  "(B)  use  grant  funds  to  integrate  qualified 

15  health  information  technology  into  community- 

16  based  clinical  education. 

17  "(2)  Limitation. — ^An  ehgible  entity  vshall  not 

18  use  amounts  received  under  a  grant  under  sub- 

19  section  (a)  to  purchase  hardware,  software,  or  sen^- 

20  ices. 

21  "(d)  Matching  Funds. — 

22  "(1)  In  general. — The  Secretary  may  award 

23  a  grant  to  an  entity  under  this  section  only  if  the 

24  entity  agrees  to  make  available  non-Federal  con- 

25  tributions  toward  the  costs  of  the  program  to  be 
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1  funded  under  the  grant  in  an  amount  that  is  not 

2  less  than  $1  for  each  $2  of  Federal  funds  provided 

3  under  the  grant. 

4  "(2)  Determination  of  amount  contrib- 

5  UTED. — Non-Federal  contributions  under  paragraph 

6  (1)  may  be  in  cash  or  in  kind,  fairly  evaluated,  in- 

7  eluding  equipment  or  services.  Amounts  provided  by 

8  the  Federal  Government,  or  services  assisted  or  sub- 

9  sidized  to  any  significant  extent  by  the  Federal  Gov- 

10  ernment,  may  not  be  included  in  determining  the 

1 1  amount  of  such  contributions. 

12  "(e)  Evaluation. — The  Secretary  shall  take  such 

13  action  as  may  be  necessary  to  evaluate  the  projects  funded 

14  under  this  section  and  publish,  make  available,  and  dis- 

15  seminate  the  results  of  such  evaluations  on  as  wide  a  basis 

16  as  is  practicable. 

17  "(f)  Reports. — Not  later  than  1  year  after  the  date 

18  of  enactment  of  this  title,  and  annually  thereafter,  the  Sec- 

19  retary  shall  submit  to  the  Committee  on  Health,  Edu- 

20  cation.  Labor,  and  Pensions  and  the  Committee  on  Fi- 

21  nance  of  the  Senate,  and  the  Committees  on  Energy  and 

22  Commerce  and  Ways  and  Means  of  the  House  of  Rep- 

23  resentatives  a  report  that — 

24  "(1)  describes  the  specific  projects  established 

25  under  this  section;  and 
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1  "(2)  contains  recommendations  for  Congress 

2  based  on  the  evaluation  conducted  under  subsection 

3  (e). 

4  "(g)  Authorization  of  Appropriations. — There 

5  is  authorized  to  be  appropriated  to  carry  out  this  section, 

6  $10,000,000  for  each  of  fiscal  years  2009  through  2011. 

7  "(h)  Sunset. — This  section  shall  not  apply  after 

8  September  30,  2011.". 

9  TITLE  IV— PRIVACY  AND 

10  SECURITY  PROVISIONS 

1 1  SEC.  400.  DEFINITIONS. 

12  In  this  title,  except  as  specified  otherwise: 

13  (1)  Breach. — The  term  "breach"  means  the 

14  unauthorized  acquisition,  access,  or  disclosure  of 

15  protected  health  information  which  compromises  the 

16  security,  privacy,  or  integrity  of  protected  health  in- 

17  formation  maintained  by  or  on  behalf  of  a  person. 

18  Such  term  does  not  include  any  unintentional  acqui- 

19  sition  or  access  of  such  information  by  an  employee 

20  or  agent  of  the  covered  entity  or  business  associate 

21  involved  if  such  acquisition  or  access,  respectively, 

22  was  made  in  good  faith  and  within  the  course  and 

23  scope  of  the  employment  or  other  contractual  rela- 

24  tionship  of  such  employee  or  agent,  respectively, 

25  with  the  covered  entity  or  business  associate  and  if 
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1  such  information  is  not  further  acquired,  accessed, 

2  or  disclosed  by  such  employee  or  agent. 

3  (2)  Business  associate. — The  term  "business 

4  associate"  has  the  meaning  given  such  term  in  sec- 

5  tion  160.103  of  title  45,  Code  of  Federal  Regula- 

6  tions. 

7  (3)  Covered  entity. — The  term  "covered  en- 

8  tity"  has  the  meaning  given  such  term  in  section 

9  160.103  of  title  45,  Code  of  Federal  Regulations. 

10  (4)  Disclose. — The  terms  "disclose"  and  "dis- 

11  closure"  have  the  meaning  given  the  term  "disclo- 

12  sure"  in  section  160.103  of  title  45,  Code  of  Federal 

13  Regulations. 

14  (5)  Electronic  health  record. — The  term 

15  "electronic    health    record"    means    an  electronic 

16  record  of  health-related  information  on  an  individual 

17  that  is  created,  gathered,  managed,  and  consulted  by 

18  authorized  health  care  clinicians  and  staff  of  one  or 

19  more   organizations,   that  conforms  to  standards 

20  adopted  under  section  3003(a)  of  the  Public  Health 

21  Service  Act,  as  added  by  section  101,  and  is  made 

22  accessible  electronically  to  other  health  care  organi- 

23  zations  and  other  authorized  users. 

24  (6)  Electronic  medical  record. — The  term 

25  "electronic  medical  record"  means  an  electronic 
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1  record  of  individually  identifiable  health  information 

2  on  an  individual  that  is  created,  gathered,  managed, 

3  and  consulted  by  authorized  health  care  clinicians 

4  and  staff  within  a  single  organization. 

5  (7)  Health  care  operations. — The  term 

6  "health  care  operation"  has  the  meaning  given  such 

7  term  in  section  164.501  of  title  45,  Code  of  Federal 

8  Regulations. 

9  (8)    Health    care   provider. — The  term 

10  "health  care  provider"  has  the  meaning  given  such 

11  term  in  section  160.103  of  title  45,  Code  of  Federal 

12  Regulations. 

13  (9)  Health  plan. — The  term  "health  plan" 

14  has  the  meaning  given  such  term  in  section  1171(5) 

15  of  the  Social  Security  Act,  as  amended  by  section 

16  415. 

17  (10)    National    coordinator. — The  term 

18  "National  Coordinator"  means  the  head  of  the  Of- 

19  fice  of  the  National  Coordinator  for  Health  Informa- 

20  tion  Technology  established  under  section  3001(a)  of 

21  the  Public  Health  Service  Act,  as  added  by  section 

22  101. 

23  (11)  Payment. — The  term  "payment"  has  the 

24  meaning  given  such  term  in  section  164.501  of  title 

25  45,  Code  of  Federal  Regulations. 
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1  (12)  Personal  health  record. — The  term 

2  "personal  health  record"  means  an  electronic  record 

3  of  individually  identifiable  health  information  on  an 

4  individual  that  can  be  drawn  from  multiple  sources 

5  and  that  is  managed,  shared,  and  controlled  by  or 

6  for  the  individual. 

7  (13)  Protected  health  information. — The 

8  term  "protected  health  information"  has  the  mean- 

9  ing  given  such  term  in  section  160.103  of  title  45, 

10  Code  of  Federal  Regulations. 

11  (14)     Secretary. — The    term  "Secretary" 

12  means  the  Secretary  of  Health  and  Human  Services. 

13  (15)  Security. — The  term  "security"  has  the 

14  meaning  given  such  term  in  section  164.304  of  title 

15  45,  Code  of  Federal  Regulations. 

16  (16)  State. — The  term  "State"  means  each  of 

17  the  several  States,  the  District  of  Columbia,  Puerto 

18  Rico,  the  Virgin  Islands,  Guam,  American  Samoa, 

19  and  the  Northern  Mariana  Islands. 

20  (17)  Treatment. — The  term  "treatment"  has 

21  the  meaning  given  such  term  in  section  164.501  of 

22  title  45,  Code  of  Federal  Regulations. 

23  (18)  Use. — The  term  "use"  has  the  meaning 

24  given  such  term  in  section  160.103  of  title  45,  Code 

25  of  Federal  Regulations. 
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1  (19)     Vendor     of     personal  heaijTH 

2  RECORDS. — The  term  "vendor  of  personal  health 

3  records"  means  an  entity  that  offers  or  maintains  a 

4  personal  health  record.  Such  term  does  not  include 

5  an  entity  that  is  a  covered  entity  for  purposes  of  of- 

6  fering  or  maintaining  such  personal  health  record. 

7  Subtitle  A — Improved  Privacy 

8  Provisions  and  Security  Provisions 

9  SEC.  401.  APPLICATION  OF  SECURITY  PROVISIONS  AND 

10  PENALTIES   TO   BUSINESS  ASSOCIATES  OF 

11  COVERED  ENTITIES;  ANNUAL  GUIDANCE  ON 

12  PRIVACY  AND  SECURITY  PROVISIONS. 

13  (a)  Application  of  Security  Provisions. — Sec- 

14  tions  164.308,  164.310,  164.312,  and  164.316  of  title  45, 

15  Code  of  Federal  Reflations,  and  any  applicable  security 

16  standards  adopted  by  the  Secretary  under  section  3003(a) 

17  of  the  Public  Health  Service  Act,  as  added  by  section  101, 

18  shall  apply  to  a  business  associate  of  a  covered  entity  in 

19  the  same  manner  that  such  sections  and  standards,  re- 

20  spectively,  apply  to  the  covered  entity. 

21  (b)  Application  op  Civil  and  Criminai.  Pen- 

22  ALTIES. — Sections  1176  and  1177  of  the  Social  Security 

23  Act  (42  U.S.C.  1320d-5,  1320d-6)  shall  apply  to  a  busi- 

24  ness  associate  of  a  covered  entity  with  respect  to  a  section 

25  applied  under  subsection  (a)  to  such  business  associate  in 
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1  the  same  manner  that  such  sections  apply  to  a  covered 

2  entity  with  respect  to  such  section. 

3  (c)  Annual  Guidance. — Not  later  than  12  months 

4  after  the  date  of  the  enactment  of  this  Act  and  annually 

5  thereafter,  the  Secretary  of  Health  and  Human  Services 

6  shaU,  in  consultation  with  industry  stakeholders,  annually 

7  issue  guidance  on  the  latest  privacy  and  security  safeguard 

8  technologies  for  use  in  carrying  out  the  sections  described 

9  in  subsection  (a). 

10  SEC.  402.  NOTIFICATION  IN  THE  CASE  OF  BREACH. 

11  (a)  In  General. — ^A  covered  entity  that  accesses, 

12  maintains,  retains,  modifies,  records,  stores,  destroys,  or 

13  othei'wise  holds,  uses,  or  discloses  unsecured  protected 

14  health  information  (as  defined  in  subsection  (h)(1))  shall, 

15  in  the  case  of  a  breach  of  such  information  that  is  discov- 

16  ered  by  the  covered  entity,  notify  each  individual  whose 

17  unsecured  protected  health  information  has  been,  or  is 

18  reasonably  believed  by  the  covered  entity  to  have  been, 

19  accessed,  acquired,  or  disclosed  as  a  result  of  such  breach. 

20  (b)  Notification  of  Covered  Entity  by  Busi- 

21  NESS  Associate. — ^A  business  associate  of  a  covered  enti- 

22  ty  that  accesses,  maintains,  retains,  modifies,  records, 

23  stores,  destroys,  or  otherwise  holds,  uses,  or  discloses  un- 

24  secured  protected  health  information  shall,  following  the 

25  discovery  of  a  breach  of  such  information,  notify  the  cov- 
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1  ered  entity  of  such  breach.  Such  notice  shall  include  the 

2  identification  of  each  individual  whose  unsecured  protected 

3  health  information  has  been,  or  is  reasonably  believed  by 

4  the  business  associate  to  have  been,  accessed,  acquired, 

5  or  disclosed  during  such  breach. 

6  (c)  Bke ACHES  Treated  as  Discovered. — For  pur- 

7  poses  of  this  section,  a  breach  shall  be  treated  as  discov- 

8  ered  by  a  covered  entity  or  by  a  business  associate  as  of 

9  the  first  day  on  which  such  breach  is  known  to  such  entity 

10  or  associate,  respectively,  (including  any  person  that  is  an 

11  employee,  officer,  or  other  agent  of  such  entity  or  asso- 

12  ciate,  respectively)  or  should  reasonably  have  been  known 

13  to  such  entity  or  associate  (or  person)  to  have  occurred. 

14  (d)  Timeliness  of  Notification. — 

15  (1)  In  general. — Subject  to  subsection  (g),  all 

16  notifications  required  under  this  section  shall  be 

17  made  without  unreasonable  delay  and  in  no  case 

18  later  than  60  calendar  days  after  the  discovery  of  a 

19  breach  by  the  covered  entity  involved  (or  business 

20  associate  involved  in  the  case  of  a  notification  re- 

21  quired  under  subsection  (b)). 

22  (2)  Burden  of  proof. — The  covered  entity  in- 

23  volved  (or  business  associate  involved  in  the  case  of 

24  a  notification  required  under  subsection  (b)),  shall 

25  have  the  burden  of  demonstrating  that  all  notifica- 
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1  tions  were  made  as  required  under  this  subtitle,  in- 

2  eluding  evidence  demonstrating  the  necessity  of  any 

3  delay. 

4  (e)  Methods  of  Notice. — 

5  (1)    Individual    notice. — Notice  required 

6  under  this  section  to  be  provided  to  an  individual, 

7  with  respect  to  a  breach,  shall  be  provided  promptly 

8  and  in  the  following  form: 

9  (A)  Written  notification  by  first-class  mail 

10  to  the  individual  (or  the  next  of  kin  of  the  indi- 

11  vidual  if  the  individual  is  deceased)  at  the  last 

12  known  address  of  the  individual  or  the  next  of 

13  kin,  respectively,  or,  if  specified  as  a  preference 

14  by  the  individual,  by  electronic  mail.  The  notifi- 

15  cation  may  be  provided  in  one  or  more  mailings 

16  as  information  is  available. 

17  (B)  In  the  case  in  which  there  is  insuffi- 

18  cient,  or  out-of-date  contact  information  that 

19  precludes  direct  written  (or,  if  specified  by  the 

20  individual  under  subparagraph  (A),  electronic) 

21  notification  to  the  individual,  a  substitute  form 

22  of  notice  shall  be  provided,  including  a  con- 

23  spicuous  posting  on  the  home  page  of  the  Web 

24  site  of  the  covered  entity  involved  or  notice  in 

25  major   print   or   broadcast   media,  including 
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1  major  media  in  geographic  areas  where  the  in- 

2  dividuals  affected  by  the  breach  hkely  reside. 

3  Such  a  notice  in  media  will  include  a  toll-free 

4  phone  number  where  an  individual  can  learn 

5  whether  or  not  the  individual's  unsecured  pro- 

6  tected  health  information  is  possibly  included  in 

7  the  breach. 

8  (C)  In  any  case  deemed  by  the  covered  en- 

9  tity  involved  to  require  urgency  because  of  pos- 

10  sible  imminent  misuse  of  unsecured  protected 

11  health  information,  the  covered  entity,  in  addi- 

12  tion  to  notice  provided  under  subparagraph  (A), 

13  may  provide  information  to  individuals  by  tele- 

14  phone  or  other  means,  as  appropriate. 

15  (2)  Media  notice. — Notice  shall  be  provided 

16  to  prominent  media  outlets  serving  a  State  or  juris- 

17  diction,  following  the  discovery  of  a  breach  described 

18  in  subsection  (a),  if  the  unsecured  protected  health 

19  information  of  more  than  500  residents  of  such 

20  State  or  jurisdiction  is,  or  is  reasonably  believed  to 

21  have  been,  accessed,  acquired,  or  disclosed  during 

22  such  breach. 

23  (3)  Notice  to  secretary. — Notice  shall  be 

24  provided  to  the  Secretary  by  covered  entities  of  un- 
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1  secured  protected  health  information  that  has  been 

2  acquired  or  disclosed  in  a  breach. 

3  (4)  Posting  on  hhs  public  website. — The 

4  Secretary  shall  make  available  to  the  public  on  the 

5  Internet  website  of  the  Department  of  Health  and 

6  Human  Services  a  list  that  identifies  each  covered 

7  entity  involved  in  a  breach  described  in  subsection 

8  (a)  in  which  the  unsecured  protected  health  informa- 

9  tion  of  more  than  1,000  individuals  is  acquired  or 

10  disclosed. 

1 1  (f)  Content  of  Notification. — Regardless  of  the 

12  method  by  which  notice  is  provided  to  individuals  under 

13  this  section,  notice  of  a  breach  shall  include,  to  the  extent 

14  possible,  the  following: 

15  (1)  A  brief  description  of  what  happened,  in- 

16  eluding  the  date  of  the  breach  and  the  date  of  the 

17  discovery  of  the  breach,  if  known. 

18  (2)  A  description  of  the  types  of  unsecured  pro- 

19  tected  health  information  that  were  involved  in  the 

20  breach  (such  as  full  name,  Social  Security  number, 

21  date  of  birth,  home  address,  account  number,  or  dis- 

22  ability  code). 

23  (3)  The  steps  individuals  should  take  to  protect 

24  themselves  from  potential  harm  resulting  from  the 

25  breach. 
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1  (4)  A  brief  description  of  what  the  covered  enti- 

2  ty  involved  is  doing  to  investigate  the  breach,  to 

3  mitigate  losses,  and  to  protect  against  any  further 

4  breaches. 

5  (5)  Contact  procedures  for  individuals  to  ask 

6  questions  or  learn  additional  information,  which 

7  shall  include  a  toll-free  telephone  number,  an  e-mail 

8  address,  Web  site,  or  postal  address. 

9  (g)  Delay  of  Notification  Authorized  for  Law 


10  Enforcement  Purposes. — If  a  law  enforcement  official 

1 1  determines  that  a  notification,  notice,  or  posting  required 

12  under  this  section  would  impede  a  criminal  investigation 

13  or  cause  damage  to  national  security,  such  notification, 

14  notice,  or  posting  shall  be  delayed  in  the  same  manner 

15  as  provided  under  section  164.528(a)(2)  of  title  45,  Code 

16  of  Federal  Regulations,  in  the  case  of  a  disclosure  covered 

17  under  such  section. 


18  (h)  Unsecured  Protected  Health  Informa- 

19  TION. — 

20  (1)  Definition. — 

21  (A)  In  generate. — Subject  to  subpara- 

22  graph  (B),  for  purposes  of  this  section,  the 

23  term  "unsecured  protected  health  information" 

24  means  protected  health  information  that  is  not 

25  protected  through  the  use  of  a  technology  or 
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1  methodology  specified  by  the  Secretary  in  the 

2  guidance  issued  under  paragraph  (2), 

3  (B)  Exception  in  case  timely  guid- 

4  ANCE  NOT  ISSUED. — In  the  case  that  the  Sec- 

5  retary  does  not  issue  guidance  under  paragraph 

6  (2)  by  the  date  specified  in  such  paragraph,  for 

7  purposes  of  this  section,  the  term  "unsecured 

8  protected  health  information"  shall  mean  infor- 

9  mation  that  is  not  protected  by  technology 

10  standards  developed  or  endorsed  by  a  standards 

11  developing  organization  that  is  accredited  by 

12  the  American  National  Standards  Institute. 

13  (2)  Guidance. — For  purposes  of  paragraph  (1) 

14  and  section  415(f),  not  later  than  the  date  that  is 

15  60  days  after  the  date  of  the  enactment  of  this  Act, 

16  the  Secretary  shall,  after  consultation  with  stake- 

17  holders,  issue  (and  annually  update)  guidance  speci- 

18  fying  the  technologies  and  methodologies  that  render 

19  protected  health  information  unusable,  unreadable, 

20  or  indecipherable  to  unauthorized  individuals. 

21  (i)  Report  to  Congress  on  Breaches. — 

22  (1)  In  GENERAIj. — Not  later  than  12  months 

23  after  the  date  of  the  enactment  of  this  Act  and  an- 

24  nually  thereafter,  the  Secretary  shall  prepare  and 

25  submit  to  the  Committee  on  Finance  and  the  Com- 
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1  mittee  on  Health,  Education,  Labor,  and  Pensions 

2  of  the  Senate  and  the  Committee  on  Ways  and 

3  Means  and  the  Committee  on  Energy  and  Commerce 

4  of  the  House  of  Representatives  a  report  containing 

5  the  information  described  in  paragraph  (2)  regard- 

6  ing  breaches  for  which  notice  was  provided  to  the 

7  Secretary  under  subsection  (e)(3). 

8  (2)  Information. — The  information  described 

9  in  this  paragraph  regarding  breaches  specified  in 

10  paragraph  (1)  shall  include — 

11  (A)    the   number   and   nature   of  such 

12  breaches; 

13  (B)   actions  taken  in  response  to  such 

14  breaches;  and 

15  (C)  any  recommendations  described  in  sec- 

16  tion  422(b)(9)  made  by  the  National  Coordi- 

17  nator  for  the  year  involved. 

18  (j)  Effective  Date. — The  provisions  of  this  section 


19  shall  apply  to  breaches  that  are  discovered  on  or  after  the 

20  date  that  is  90  days  after  the  date  of  the  enactment  of 

21  this  Act. 

22  SEC.  403.  EDUCATION  ON  HEALTH  INFORMATION  PRIVACY 

23  AND  REPORT  ON  COMPLIANCE. 

24  (a)  Regional  Office  Pkiva(^y  Aimsoiis.— Not 

25  later  than  6  months  after  the  date  of  the  enact ineni  of 
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1  this  Act,  the  Secretary  shall  designate  an  individual  in 

2  each  regional  office  of  the  Department  of  Health  and 

3  Human  Services  to  offer  guidance  and  education  to  cov- 

4  ered  entities,  business  associates,  and  individuals  on  their 

5  rights  and  responsibilities  related  to  Federal  privacy  and 

6  security  requirements  for  protected  health  information. 


7  (b)  Report  on  Compliance. — 

8  (1)  In  general. — Not  later  than  24  months 

9  after  the  date  of  the  enactment  of  this  Act  and  an- 

10  nually  thereafter,  the  Secretary  shall  prepare  and 

11  submit  to  the  Committee  on  Finance  and  the  Com- 

12  mittee  on  Health,  Education,  Labor,  and  Pensions 

13  of  the  Senate  and  the  Committee  on  Ways  and 

14  Means  and  the  Committee  on  Energy  and  Commerce 

15  of  the  House  of  Representatives  a  report  concerning 

16  the  number  of  audits  performed  and  a  summary  of 

17  audit  findings  pursuant  to  section  414  and  com- 

18  plaints  of  alleged  violations  of  the  provisions  of  sec- 

19  tions  401  and  402,  the  provisions  of  subtitle  B,  and 

20  the  provisions  of  subparts  C  and  E  of  title  45,  Code 

21  of  Federal  Regulations  that  are  received  by  the  Sec- 

22  retary  during  the  year  for  which  the  report  is  being 

23  prepared.  Each  such  report  shall  include,  with  re- 

24  spect  to  such  complaints  received  during  the  year — 

25  (A)  the  number  of  such  complaints; 
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1  (B)  the  number  of  such  complamts  re- 

2  soh^ed  informahy,  a  summary  of  the  types  of 

3  such  complaints  so  resolved,  and  the  number  of 

4  covered  entities  that  received  technical  assist- 

5  ance  from  the  Secretary  during  such  year  in 

6  order  to  achieve  compliance  with  such  provi- 

7  sions  and  the  types  of  such  technical  assistance 

8  provided; 

9  (C)  the  number  of  such  complaints  that  re- 

10  suited  in  the  imposition  of  ci\il  money  penalties, 

11  the  amount  of  the  civil  money  penalty  imposed 

12  in  each  such  case,  and  a  summary  of  the  basis 

13  for  each  such  civil  money  penalty; 

14  (D)  the  number  of  compliance  reviews  con- 

15  ducted  and  the  outcome  of  each  such  review; 

16  (E)  the  number  of  subpoenas  or  inquiries 

17  issued;  and 

18  (F)   the   Secretary's  plan  for  impro^dng 

19  compliance  with  and  enforcement  of  such  provi- 

20  sions  for  the  following  year. 

21  (2)  Availability  to  public. — Each  report 

22  under  paragraph  (1)  shall  be  made  available  to  the 

23  public  on  the  Internet  website  of  the  Department  of 

24  Health  and  Human  Services. 
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1  (c)  Education  Initiative  on  Uses  of  Health  In- 

2  formation. — 

3  (1)  In  GENERAI.. — Not  later  than  12  months 

4  after  the  date  of  the  enactment  of  this  Act,  the  Of- 

5  fice  for  Civil  Rights  within  the  Department  of 

6  Health  and  Human  Services  shall  develop  and  main- 

7  tain  a  multi-faceted  national  education  initiative  to 

8  enhance  public  transparency  regarding  the  uses  of 

9  protected  health  information,  including  programs  to 

10  educate  individuals  about  the  potential  uses  of  their 

11  protected  health  information,  the  effects  of  such 

12  uses,  and  the  rights  of  individuals  with  respect  to 

13  such  uses.  Such  programs  shall  be  conducted  in  a 

14  variety  of  languages  and  present  information  in  a 

15  clear  and  understandable  manner. 

16  (2)  Authorization  of  appropriations. — 

17  There  is  authorized  to  be  appropriated  to  carry  out 

18  paragraph  (1),  $10,000,000  for  the  period  of  fiscal 

19  years  2009  through  2013. 

20  sec.  404.  application  of  penalties  to  business  asso- 

21  ciates  of  covered  entities  for  VIOLA- 

22  TIONS    OF    PRIVACY   CONTRACT  REQUIRE- 

23  MENTS. 

24  (a)  Application  of  Contract  Requirements. — 

25  In  the  case  of  a  business  associate  of  a  covered  entity  that 
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1  obtains  or  creates  protected  health  information  pursuant 

2  to  a  written  contract  (or  other  written  arrangement)  de- 

3  scribed  in  section  164.502(e)(2)  of  title  45,  Code  of  Fed- 

4  eral  Regulations,  with  such  covered  entity,  the  business 

5  associate  may  use  and  disclose  such  protected  health  infor- 

6  mation  only  if  such  use  or  disclosure,  respectively,  is  in 

7  compliance  with  each  applicable  requirement  of  section 

8  164.504(e)  of  such  title  and  section  405(b). 

9  (b)  Application  of  Knowledge  Elements  Asso- 

10  ciated  With  Contracts. — Section  164.504(e) (l)(ii)  of 

11  title  45,  Code  of  Federal  Regulations,  shall  apply  to  a 

12  business  associate  described  in  subsection  (a),  with  respect 

13  to  compliance  with  such  subsection,  in  the  same  manner 

14  that  such  section  applies  to  a  covered  entity,  with  respect 

15  to  compliance  with  the  standards  in  sections  164.502(e) 

16  and  164.504(e)  of  such  title,  except  that  in  appljdng  such 

17  section  164.504(e)(l)(ii)  each  reference  to  the  business  as- 

18  sociate,  with  respect  to  a  contract,  shall  be  treated  as  a 

19  reference  to  the  covered  entity  involved  in  such  contract. 

20  (c)  Application  of  Civil  and  Criminai.  Pen- 

21  ALTIES. — In  the  case  of  a  business  associate  that  \dolates 

22  any  provision  of  subsection  (a)  or  (b),  the  provisions  of 

23  sections  1176  and  1177  of  the  Social  Security  Act  (42 

24  U.S.C.  1320d-5,  1320d-6)  shall  apply  to  the  business  as- 

25  sociate  with  respect  to  such  violation  in  the  same  maimer 
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1  as  such  provisions  apply  to  a  person  who  violates  a  provi- 

2  sion  of  part  C  of  title  XI  of  such  Act. 

3  SEC.  405.  RESTRICTIONS  ON  CERTAIN  USES  AND  DISCLO- 


4  SURES  AND  SALES  OF  HEALTH  INFORMA- 

5  TION;  ACCOUNTING  OF  CERTAIN  PROTECTED 

6  HEALTH   INFORMATION   DISCLOSURES;  AC- 

7  CESS  TO  CERTAIN  INFORMATION  IN  ELEC- 

8  TRONIC  FORMAT. 

9  (a)  Requested  Restrictions  on  Certain  Dis- 


10  CLOSURES  OP  Health  Information. — In  the  case  that 

11  an  individual  requests  under  paragraph  (a)(l)(i)(A)  of 

12  section  164.522  of  title  45,  Code  of  Federal  Regulations, 

13  that  a  covered  entity  restrict  the  disclosure  of  the  pro- 

14  tected  health  information  of  the  individual,  notwith- 

15  standing  paragraph  (a)(1) (ii)  of  such  section,  the  covered 

16  entity  must  comply  with  the  requested  restriction  if- — 


17  (1)  except  as  otherwise  required  by  law,  the  dis- 

18  closure  is  to  a  health  plan  for  purposes  of  carrying 

19  out  payment  or  health  care  operations  (and  is  not 

20  for  purposes  of  carrying  out  treatment);  and 

21  (2)  the  protected  health  information  pertains 

22  solely  to  a  health  care  item  or  service  for  which  the 

23  health  care  provider  involved  has  been  paid  out  of 

24  pocket  in  full. 
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1  (b)  Disclosures  Required  To  Be  Limited  to 

2  THE  Limited  Data  Set  or  the  Minimum  Nec- 

3  ESSARY. — 

4  (1)  Transitional  rule. — 

5  (A)  In  general. — Subject  to  subpara- 

6  graph  (B),  a  covered  entity  shall  be  treated  as 

7  being  in  compliance  with  section  164.502(b)(1) 

8  of  title  45,  Code  of  Federal  Regulations,  and 

9  for  purposes  of  section  404(a)  a  business  asso- 

10  ciate  shall  be  treated  as  being  in  compliance 

11  with  this  subsection,  with  respect  to  the  use, 

12  disclosure,  or  request  of  protected  health  infor- 

13  mation  described  in  such  section,  only  if  the 

14  covered  entity  or  business  associate,  respec- 

15  tively,  limits  such  protected  health  information, 

16  to  the  extent  practicable,  to  either  the  limited 

17  data  set  (as  defined  in  section  164.514(e)(2)  of 

18  such  title)  or  to  the  minimum  necessary  to  ac- 

19  eomplish  the  intended  purpose  of  such  use,  dis- 

20  closure,  or  request,  respectively. 

21  (B)  Sunset. — Subparagraph  (A)  shall  not 

22  apply  on  and  after  the  earlier  of — 

23  (i)  the  effective  date  on  which  the 

24  Secretary  adopts,  taking  into  consideration 

25  the  regulations  promulgated  under  section 
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1  406(d),  the  study  under  section  410,  and 

2  the  report  under  section  411,  a  standard 

3  under  section  3003(a)  of  the  Pubhc  Health 

4  Service  Act,  as  added  by  section  101, 

5  which  defines  the  term  "minimum  nec- 

6  essary"  for  purposes  of  subpart  E  of  part 

7  164  of  title  45,  Code  of  Federal  Regula- 

8  tions;  or 

9  (ii)   the   National   Coordinator  rec- 

10  ommends      guidance      under  section 

11  3001(c)(2)  of  such  Act  which  defines  such 

12  term  for  such  purposes. 

13  (2)    Determination    op    minimum  nec- 

14  essary. — For  purposes  of  paragraph  (1),  in  the 

15  case  of  the  disclosure  of  protected  health  informa- 

16  tion,  the  covered  entity  or  business  associate  dis- 

17  closing  such  information  shall  determine  what  con- 

18  stitute  the  minimum  necessary  to  accomplish  the  in- 

19  tended  purpose  of  such  disclosure. 

20  (3)  Application  op  exceptions. — The  excep- 

21  tions  described  in  section  164.502(b)(2)  of  title  45, 

22  Code  of  Federal  Regulations,  shall  apply  to  the  re- 

23  quirement  under  paragraph  (1)  as  of  the  effective 

24  date  described  in  section  433  in  the  same  manner 
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1  that  such  exceptions  apply  to  section  164.502(b)(1) 

2  of  such  title  before  such  date. 

3  (4)  Rule  of  construction. — Nothing  in  this 

4  subsection  shall  be  construed  as  affecting  the  use, 

5  disclosure,  or  request  of  protected  health  information 

6  that  has  been  de-identified  to  the  greatest  extent 

7  practicable  rather  than  the  use  of  protected  health 

8  information  that  has  been  limited  to  the  limited  data 

9  set. 

10  (c)  Accounting  of  Certain  Protected  Health 

11  Information  Disclosures  Required  if  Coahered  En- 

12  TiTY  Uses  Electronic  Medical  Record  or  Elec- 

13  TRONIC  Health  Record. — 

14  (1)  In  GENERAL. — In  applying  section  164.528 

15  of  title  45,  Code  of  Federal  Regulations,  in  the  case 

16  of  protected  health  information  used  or  maintained 

17  by  a  covered  entity  in  an  electronic  medical  record 

18  or  an  electronic  health  record — 

19  (A)  the  exception  under  section  paragraph 

20  (a)(l)(i)  of  such  section  shall  not  apply  to  dis- 

21  closures  (other  than  oral  disclosures)  made  by 

22  such  entity  of  such  information;  and 

23  (B)  an  individual  shall  have  a  right  to  re- 

24  ceive  an  accounting  of  disclosures  {lescri})ed  in 

25  such  paragraph  of  such  inf()rmati()n  made  by 
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1  such  covered  entity  during  only  the  three  years 

2  prior  to  the  date  on  which  the  accounting  is  re- 

3  quested. 

4  (2)  Effective  date. — The  provisions  of  this 

5  subsection  shall  apply  to  disclosures,  with  respect  to 

6  protected  health  information,  made  by  a  covered  en- 

7  tity  on  or  after  the  sooner  of  the  following  dates: 

8  (A)  In  the  case  of  an  entity  that  does  not 

9  use  or  maintain  an  electronic  medical  record  or 

10  electronic  health  record  before  the  date  of  the 

11  enactment  of  this  Act  with  respect  to  such  in- 

12  formation,  the  date  on  which  the  covered  entity 

13  first  uses  or  maintains  an  electronic  medical 

14  record  or  electronic  health  record,  with  respect 

15  to  such  information,  and  in  the  case  of  an  enti- 

16  ty  that  uses  or  maintains  an  electronic  medical 

17  record  or  electronic  health  record  with  respect 

18  to  such  information  before  such  date  of  enact- 

19  ment,  the  date  on  which  the  covered  entity  up- 

20  grades  such  electronic  medical  record  or  elec- 

21  tronic  health  record. 

22  (B)  If  a  standard  that  relates  to  tech- 

23  nologies  that  allow  for  an  accounting  for  disclo- 

24  sures  made  by  a  covered  entity  for  purposes  of 

25  treatment,  payment,  and  health  care  operations 
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1  is  adopted  under  section  3003(a)  of  the  Public 

2  Health  Service  Act,  as  added  by  section  101, 

3  the  date  that  is  6  months  after  the  date  of  such 

4  adoption. 

5  (d)  Prohibition  on  Certain  Disclosures. — 

6  (1)  In  general. — The  foUowing  uses  and  dis- 

7  closures  shall  not  be  considered  to  be  permitted  uses 

8  or  disclosures  of  protected  health  information  for 

9  purposes  of  subparts  C  and  E  of  part  164  of  title 

10  45,  Code  of  Federal  Regulations: 

11  (A)  Sale  of  protected  health  infor- 

12  MATION. — The  sale  of  any  protected  health  in- 

13  formation  of  an  individual  by  a  covered  entity 

14  or  business  associate  unless  the  covered  entity 

15  or  business  associate  obtains  from  the  indi- 

16  vidual,  in  accordance  v^th  section  164.508  of 

17  title  45,  Code  of  Federal  Regulations,  a  valid 

18  authorization  (as  described  in  paragraph  (b)  of 

19  such  section)  to  sell  such  information  or  unless 

20  the  sale  is  for  purposes  of  research  and  public 

21  health    activities    (as    described    in  sections 

22  164.501,  164.512(1),  and  164.512(b)  of  title 

23  45,  Code  of  Federal  Regulations)  and  tli(^  pi'ice 

24  charged  reflects  the  costs  of  prei)aration  and 

25  transmittal  of  the  data  for  such  pui-poses. 
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1  (B)  Re-identification  of  de-identi- 

2  FIED  information. — In  the  case  of  an  entity 

3  that  has  received  information  that  has  been  de- 

4  identified  in  accordance  with  section  164.514  of 

5  title  45,  Code  of  Federal  Regulations,  the  re- 

6  identification  by  the  entity  of  such  information. 

7  (C)    Identification    of  individual 

8  THROUGH  USE  OF  LIMITED  DATA  SET. — In  the 

9  case  of  an  entity  that  has  received  a  limited 

10  data  set  (as  defined  in  section  164.514(e)(2)  of 

11  title  45,  Code  of  Federal  Regulations),  the  use, 

12  alone  or  in  combination  with  other  information, 

13  of  such  set  to  identify  the  subject  of  the  data 

14  set. 

15  (2)  Limitation  on  condition. — In  no  case 

16  may  a  covered  entity  condition  the  provision  of 

17  treatment  to  an  individual,  or  pajnuent  for  such 

18  treatment,  on  the  individual  providing  authorization 

19  described  in  paragraph  (1)(A). 

20  (3)    Construction. — Nothing   in   this  sub- 

21  section  shall  be  construed  as  limiting  the  authority 

22  of  the  Secretary  to  adopt  standards  and  guidance 

23  under  section  3003(a)  of  the  Public  Health  Service 

24  Act,  as  added  by  section  101. 
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1  (4)  Effective  date. — The  provisions  of  this 

2  subsection  shall  apply  to  uses  and  disclosures  made 

3  on  or  after  the  date  of  the  enactment  of  this  Act. 

4  (e)  Access  to  Certain  Information  in  Elec- 

5  TRONIC  Format. — In  applying  section  164.524  of  title 

6  45,  Code  of  Federal  Regulations,  in  the  case  that  a  cov- 

7  ered  entity  uses  or  maintains  an  electronic  medical  record 

8  or  electronic  health  record  with  respect  to  protected  health 

9  information  of  an  individual — 

10  (1)  the  individual  shall  have  a  right  to  obtain 

11  from  such  covered  entity  a  copy  of  such  information 

12  in  an  electronic  format;  and 

13  (2)  notwithstanding  paragraph  (c)(4)  of  such 

14  section,  the  covered  entity  may  not  impose  any  fee 

15  for  providing  such  individual  with  a  copy  of  such  in- 

16  formation  (or  a  summary  or  explanation  of  such  in- 

17  formation)  if  such  copy  (or  summary  or  explanation) 

18  is  in  an  electronic  form. 

19  (f)  Application  of  Privacy  Regulations  for 

20  Making  Amendments  to  Protected  HEAi/m  Infor- 

21  MATiON  to  Information  in  Electronk^  Form^vt. — In 

22  applying  section  164.526  of  title  45,  Code  of  Regulations, 

23  in  the  case  of  protected  health  information  used  or  main- 

24  tained  by  a  covered  entity  in  an  electronic  medical  record 

25  or  electronic  health  record,  instead  of  any  timefrann^s  or 
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1  deadlines  described  in  such  section  the  Secretary  may 

2  apply  such  timeframes  and  deadlines  as  the  Secretary  de- 

3  termines  to  be  appropriate. 

4  SEC.  406.  LIMITATIONS  ON  CERTAIN  ACTIVITIES  AS  PART 

5  OF  HEALTH  CARE  OPERATIONS. 

6  (a)  Marketing. — 

7  (1)  In  general. — communication  by  a  cov- 

8  ered  entity  or  business  associate  that  is  about  a 

9  product  or  service  and  that  encourages  recipients  of 

10  the  communication  to  purchase  or  use  the  product  " 

11  or  service  shall  not  be  considered  a  health  care  oper- 

12  ation  for  purposes  of  subpart  E  of  part  164  of  title 

13  45,  Code  of  Federal  Regulations,  unless  the  eommu- 

14  nication  is  made  as  described  in  subparagraph  (i), 

15  (ii),  or  (iii)  of  paragraph  (1)  of  the  definition  of 

16  marketing  in  section  164.501  of  such  title. 

17  (2)    Payment    for  certain  communica- 

18  tions. — Subject  to  subparagraph  (B),  a  covered  en- 

19  tity  or  business  associate  may  not  receive  direct  or 

20  indirect  payment  in  exchange  for  making  any  com- 

21  munication  described  in  subparagraph  (i),  (ii),  or 

22  (iii)  of  paragraph  (1)  of  the  definition  of  marketing 

23  in  section  164.501  of  title  45,  Code  of  Federal  Reg- 

24  ulations,  except — 
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1  (A)  a  business  associate  of  a  covered  entity 

2  may  receive  payment  from  the  covered  entity 

3  for  making  any  such  communication  on  behalf 

4  of  the  covered  entity  that  is  consistent  with  the 

5  Avritten  contract  (or  other  written  arrangement) 

6  described  in  section  164.502(e)(2)  of  such  title 

7  between  such  business  associate  and  covered  en- 

8  tity;  and 

9  (B)  a  covered  entity  may  receive  payment 

10  in  exchange  for  making  any  such  communica- 

11  tion  if  the  entity  obtains  from  the  recipient  of 

12  the  communication,  in  accordance  with  section 

13  164.508  of  title  45,  Code  of  Federal  Regula- 

14  tions,  a  valid  authorization  (as  described  in 

15  paragraph  (b)  of  such  section),  which  shall  be 

16  explicitly  and  affirmatively  provided  by  the  re- 

17  cipient,  with  respect  to  such  communication. 

18  (b)  Fund  Raising. — Fundraising  for  the  benefit  of 

19  a  covered  entity  shall  not  be  considered  a  health  care  oper- 

20  ation  for  purposes  of  section  164.501  of  title  45,  Code  of 

21  Federal  Regulations. 

22  (c)  Effective  Date. — Subsections  (a)  and  (b)  shall 

23  apply  to  contracting  occurring  on  or  after  the  effective 

24  date  specified  under  section  433. 

25  (d)  Regulations. — 
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1  (1)  In  general. — Not  later  than  18  months 

2  after  the  date  of  the  enactment  of  this  Act,  the  Sec- 

3  retary  shall  issue  a  notice  of  proposed  rulemaking  in 

4  the  Federal  Register,  taking  into  account  the  report 

5  submitted  under  section  411  and  the  study  under 

6  section  410,  to  eliminate  from  the  definition  of 

7  health  care  operations  under  section  164.501  of  title 

8  45,  Code  of  Federal  Regulations,  those  activities 

9  (other  than  the  process  of  de-identifying  health  in- 

10  formation)  that  can  reasonably  and  efficiently  be 

1 1  conducted  through  the  use  of  information  that  is  de- 

12  identified  (in  accordance  with  the  requirements  of 

13  section  164.514(b)  of  such  title)  or  that  should  re- 

14  quire  a  valid  authorization  for  use  or  disclosure.  In 

15  promulgating  any  such  regulations,  the  Secretary 

16  may  consider  the  form  in  which  the  health  informa- 

17  tion  is  maintained,  such  as  non-electronic  records. 

18  (2)  Considerations. — In  promulgating  any 

19  such  regulations,  the  Secretary  shall  take  into  con- 

20  sideration  the  extent  to  which — 

21  (A)  specific  health  care  operations  require 

22  the  use  or  disclosure  of  protected  health  infor- 

23  mation;  and 

24  (B)   clinical  utility  of  such  information 

25  would  potentially  be  decreased  in  the  case  that 
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1  such  information  is  de-identified  or  valid  au- 

2  thorization  is  required;  and 

3  (C)  the  classification  of  health  care  oper- 

4  ations  (as  in  existence  as  of  the  date  of  the  en- 

5  actment  of  this  Act)  under  section  164.501  of 

6  title  45,  Code  of  Federal  Regulations,  may  be 

7  further  delineated. 

8  SEC.  407.  STUDY  AND  REPORT  ON  APPLICATION  OF  PRI- 

9  VACY   AND    SECURITY   REQUIREMENTS  TO 

10  NON-HIPAA  COVERED  ENTITIES. 

1 1  Not  later  than  one  year  after  the  date  of  the  enact- 


12  ment  of  this  Act,  the  Secretary,  in  consultation  with  the 

13  Federal  Trade  Commission,  shall  conduct  a  study  on  pri- 

14  vacy  and  security  requirements  to  entities  that  are  not 

15  considered  covered  entities  as  of  the  date  of  the  enactment 

16  of  this  Act  and  submit  to  the  Committee  on  Finance  and 

17  the  Committee  on  Health,  Education,  Labor,  and  Pen- 

18  sions  of  the  Senate  and  the  Committee  on  Ways  and 

19  Means  and  the  Committee  on  Energy  and  Commerce  of 

20  the  House  of  Representatives  a  report  on  the  findings  of 

21  the  study,  including — 


22  (1)  requirements  relating  to  security,  privacy, 

23  and  notification  in  the  case  of  a  breach  of  security 

24  or  privacy  (including  the  applicability  of  an  exemp- 

25  tion  to  notification  in  the  case  of  individually  identi- 
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1  fiable  health  information  that  has  been  rendered  un- 

2  usable,  unreadable,  or  indecipherable  through  tech- 

3  nologies  or  methodologies  recognized  by  appropriate 

4  professional  organization  or  standard  setting  bodies 

5  to  provide  effective  security  for  the  information)  that 

6  should  be  applied  to — 

7  (A)  vendors  of  personal  health  records; 

8  (B)  entities  that  offer  products  or  services 

9  through  the  website  of  a  vendor  of  personal 

10  health  records;  ; 

11  (C)  entities  that  are  not  covered  entities 

12  and  that  offer  products  or  services  through  the 

13  websites  of  covered  entities  that  offer  individ- 

14  uals  personal  health  records; 

15  (D)  entities  that  are  not  covered  entities 

16  and  that  access  information  in  a  personal 

17  health  record  or  send  information  to  a  personal 

18  health  record;  and 

19  (E)  third  party  service  providers  used  by  a 

20  vendor  or  entity  described  in  subparagraph  (A), 

21  (B),  (C),  or  (D)  to  assist  in  providing  personal 

22  health  record  products  or  services; 

23  (2)  a  determination  of  which  Federal  govern- 

24  ment  agency  is  best  equipped  to  enforce  such  re- 

25  quirements  recommended  to  be  applied  to  such  ven- 
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1  dors,  entities,  and  service  providers  under  paragraph 

2  (1);  and 

3  (3)  a  timeframe  for  implementing  regulations 

4  based  on  such  findings. 

5  SEC.  408.  TEMPORARY  BREACH  NOTIFICATION  REQUIRE- 

6  MENT  FOR  VENDORS  OF  PERSONAL  HEALTH 

7  RECORDS  AND  OTHER  NON-HIPAA  COVERED 

8  ENTITIES. 

9  (a)  In  Geneeal. — In  accordance  with  subsection  (c), 


10  each  vendor  of  personal  health  records,  following  the  dis- 

1 1  covery  of  a  breach  of  security  of  unsecured  PHR,  identifi- 

12  able  health  information  that  is  in  a  personal  health  record 

13  maintained  or  offered  by  such  vendor,  and  each  entity  de- 

14  scribed  in  subparagraph  (B),  (C),  or  (D)  of  section 

15  407(1),  following  the  discovery  of  a  breach  of  security  of 

16  such  information  that  is  obtained  through  a  product  or 

17  service  provided  by  such  entity,  shall — 


18  (1)  notify  each  individual  who  is  a  citizen  or 

19  resident  of  the  United  States  whose  unsecured  PHR 

20  identifiable  health  information  was  acquired  by  an 

21  unauthorized  person  as  a  result  of  such  a  breach  of 

22  security;  and 

23  (2)  notify  the  Federal  Trade  Commission. 

24  (b)  Notification  by  Third  Party  Sermci^:  Pro- 


25  viders. — third  party  service  provider  that  jx-cnides 
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1  services  to  a  vendor  of  personal  health  records  or  to  an 

2  entity  described  in  subparagraph  (B),  (C),  or  (D)  of  sec- 

3  tion  407(1)  in  connection  with  the  offering  or  maintenance 

4  of  a  personal  health  record  or  a  related  product  or  service 

5  and  that  accesses,  maintains,  retains,  modifies,  records, 

6  stores,  destroys,  or  otherwise  holds,  uses,  or  discloses  un- 

7  secured  PHR  identifiable  health  information  in  such  a 

8  record  as  a  result  of  such  services  shall,  following  the  dis- 

9  covery  of  a  breach  of  security  of  such  information,  notify 

10  such  vendor  or  entity,  respectively,  of  such  breach.  Such 

11  notice  shall  include  the  identification  of  each  individual 

12  whose  unsecured  PHR  identifiable  health  information  has 

13  been,  or  is  reasonably  believed  to  have  been,  accessed,  ac- 

14  quired,  or  disclosed  during  such  breach. 

15  (c)  Application  of  Requirements  for  Timeli- 

16  NESS,  Method,  and  Content  of  Notifications. — 

17  Subsections  (c),  (d),  (e),  and  (f)  of  section  402  shall  apply 

18  to  a  notification  required  under  subsection  (a)  and  a  ven- 

19  dor  of  personal  health  records,  an  entity  described  in  sub- 

20  section  (a)  and  a  third  party  service  provider  described 

21  in  subsection  (b),  with  respect  to  a  breach  of  security 

22  under  subsection  (a)  of  unsecured  PHR  identifiable  health 

23  information  in  such  records  maintained  or  offered  by  such 

24  vendor,  in  a  manner  specified  by  the  Federal  Trade  Com- 

25  mission. 
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1  (d)  Notification  of  the  Secretary. — Upon  re- 

2  ceipt  of  a  notification  of  a  breach  of  security  under  sub- 

3  section  (a)(2),  the  Federal  Trade  Commission  shall  notify 

4  the  Secretary  of  such  breach. 

5  (e)  Enforcement. — violation  of  subsection  (a)  or 

6  (b)  shall  be  treated  as  an  unfair  and  deceptive  act  or  prac- 

7  tice  in  violation  of  a  regulation  under  section  18(a)(1)(B) 

8  of  the   Federal   Trade   Commission  Act   (15  U.S.C. 

9  57a(a)(l)(B))  regarding  unfair  or  deceptive  acts  or  prac- 

10  tices. 

1 1  (f)  Definitions. — For  purposes  of  this  section: 

12  (1)  Breach  of  security. — The  term  "breach 

13  of  security"  means,  with  respect  to  unsecured  PHR 

14  identifiable  health  information  of  an  individual  in  a 

15  personal  health  record,  the  acquisition,  use,  or  dis- 

16  closure  of  such  information  without  the  authoriza- 

17  tion  of  the  individual. 

18  (2)  PHR  identifiable  health  informa- 

19  TION. — The  term  "PHR  identifiable  health  informa- 

20  tion"  means  individually  identifiable  health  informa- 

21  tion,  as  defined  in  section  1171(6)  of  the  Social  Se- 

22  curity  Act  (42  U.S.C.  1320d(6)),  and  includes,  with 

23  respect  to  an  individual,  information — 

24  (A)  that  is  provided  by  or  on  behalf  of  the 

25  individual;  and 
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1  (B)  that  identifies  the  individual  or  with 

2  respect  to  which  there  is  a  reasonable  basis  to 

3  believe  that  the  information  can  be  used  to 

4  identify  the  individual. 

5  (3)  Unsecured  phr  identifiable  health 

6  information. — 

7  (A)   In  GENERAL. — Subject  to  subpara- 

8  graph  (B),  the  term  "unsecured  PHR  identifi- 

9  able  health  information"  means  PHR  identifi- 

10  able  health  information  that  is  not  protected 

1 1  through  the  use  of  a  technology  or  methodology 

12  specified  by  the  Secretary  in  the  guidance 

13  issued  under  section  402(h)(2). 

14  (B)  Exception  in  case  timely  guid- 

15  ANCE  NOT  ISSUED. — In  the  case  that  the  Sec- 

16  retary  does  not  issue  guidance  under  section 

17  402(h)(2)  by  the  date  specified  in  such  section, 

18  for  purposes  of  this  section,  the  term  "unse- 

19  cured  PHR  identifiable  health  information" 

20  shall  mean  information  that  is  not  protected  by 

21  technology  standards  developed  or  endorsed  by 

22  a  standards  developing  organization  that  is  ac- 

23  credited  by  the  American  National  Standards 

24  Institute. 

25  (g)  Effective  Date;  Sunset. — 
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1  (1)  In  GENEEAL. — Subject  to  paragraph  (2), 

2  the  provisions  of  this  section  shall  apply  to  breaches 

3  of  security  occurring  during  the  period  beginning  on 

4  the  date  that  is  90  days  after  the  date  of  the  enact- 

5  ment  of  this  Act. 

6  (2)  Sunset. — The  provisions  of  this  section 

7  shall  not  apply  to  breaches  of  security  occurring  on 

8  or  after  the  earlier  of  the  following: 

9  (A)  A  standard  relating  to  requirements 

10  for  entities  that  are  not  covered  entities  that  in- 

11  eludes  requirements  relating  to  breach  notifica- 

12  tion  has  been  adopted  by  the  Secretary  under 

13  section  3002  of  the  Public  Health  Service  Act, 

14  as  added  by  section  101,  and  has  taken  effect. 

15  (B)  A  standard  relating  to  requirements 

16  for  entities  that  are  not  covered  entities  that  in- 

17  eludes  requirements  relating  to  breach  notifica- 

18  tion  has  been  promulgated  by  the  Federal 

19  Trade  Commission  and  has  taken  effect. 

20  SEC.  409.  BUSINESS  ASSOCIATE  CONTRACTS  REQUIRED 

21  FOR  CERTAIN  ENTITIES;  OTHER  PROVISIONS 

22  RELATED    TO    BUSINESS    ASSOCIATE  CON- 

23  TRACTS. 

24  (a)  In  General. — Each  organization,  with  respect 

25  to  a  covered  entity,  that  provides  data  traiismission  oi'  pro- 
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1  tected  health  information  to  such  entity  and  that  requires 

2  access  on  a  routine  basis  to  such  protected  health  informa- 

3  tion,  such  as  a  Health  Information  Exchange,  Regional 

4  Health  Information  Organization,  or  E -prescribing  Gate- 

5  way  and  each  vendor  of  a  personal  health  record  that  con- 

6  tracts  with  a  covered  entity  for  purposes  of  including  a 

7  personal  health  record  within  an  electronic  medical  record 

8  or  electronic  health  record,  is  required  to  enter  into  a  writ- 

9  ten  contract  (or  other  written  arrangement)  described  in 

10  section  164.502(e)(2)  of  title  45,  Code  of  Federal  Regula- 

11  tions  and  a  written  contract  (or  other  arrangement)  de- 

12  scribed  in  section  164.308(b)  of  such  title,  with  such  enti- 

13  ty  and  shall  be  treated  as  a  business  associate  of  the  cov- 

14  ered  entity  for  purposes  of  the  provisions  of  this  title  and 

15  subparts  C  and  E  of  title  45,  Code  of  Federal  Regulations. 

16  (b)  Covered  Entities  To  Monitor  Compliance 

17  OP  Business  Associates. — 

18  (1)  In  general. — covered  entity  shall  mon- 

19  itor  the  extent  to  which  a  business  associate  of  such 

20  entity  complies  with  the  terms  of  the  written  con- 

21  tract  (or  other  arrangement)  described  in  section 

22  164.502(e)(2)  of  title  45,  Code  of  Federal  Regula- 

23  tions  or  section  164.  308(b)  of  such  title,  as  apphca- 

24  ble,  entered  into  between  such  entity  and  such  busi- 

25  ness  associate. 
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1  (2)  Enforcement. — If  in  the  process  of  inves- 

2  tigating  a  complaint  related  to  a  violation  of  the  re- 

3  quirements  of  this  title  or  subpart  C  or  E  of  title  45, 

4  Code  of  Federal  Regulations,  committed  by  a  busi- 

5  ness  associate  of  a  covered  entity,  the  Office  for 

6  Civil  Rights  of  the  Department  of  Health  and 

7  Human  Services  determines  that — 

8  (A)  the  covered  entity  reasonably  should 

9  have  known  of  a  pattern  of  activity  or  practice 

10  of  the  business  associate  that  was  not  in  com- 

11  pliance  with  the  terms  of  a  contract  described 

12  in  paragraph  (1)  and  that  relates  to  such  viola- 

13  tion;  and 

14  (B)  the  covered  entity  did  not  take  action 

15  required  under  section  164.504(e)(l)(ii)  of  title 

16  45,  Code  of  Federal  Regulations  in  response  to 

17  such  pattern  or  practice, 

18  the  covered  entity  shall  be  treated,  for  purposes  of 

19  section  1176  of  the  Social  Security  Act  (42  U.S.C. 

20  1320d-5),  as  having  violated  part  C  of  title  XI  of 

21  such  Act. 
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1  SEC.  410.  GUIDANCE  ON  IMPLEMENTATION  SPECIFICATION 

2  TO  DE-IDENTIFY  PROTECTED  HEALTH  INFOR- 

3  MATION. 

4  Not  later  than  12  months  after  the  date  of  the  enact- 

5  ment  of  this  Act,  the  Secretary  shall,  in  consultation  with 

6  stakeholders,  issue  guidance  on  how  best  to  implement  the 

7  requirements  for  the  de-identification  of  protected  health 

8  information  under  section  164.514(b)  of  title  45,  Code  of 

9  Federal  Regulations. 

10  SEC.  411.  GAO  REPORT  ON  TREATMENT,  PAYMENT,  AND 

11  HEALTH  CARE  OPERATIONS  USES  AND  DIS- 

12  CLOSURES. 

13  Not  later  than  one  year  after  the  date  of  the  enact- 

14  ment  of  this  Act,  the  Comptroller  General  of  the  United 

15  States  shall  submit  to  the  Committee  on  Finance  and  the 

16  Committee  on  Health,  Education,  Labor,  and  Pensions  of 

17  the  Senate  and  the  Committee  on  Ways  and  Means  and 

18  the  Committee  on  Energy  and  Commerce  of  the  House 

19  of  Representatives  a  report  on — 


20  (1)  the  best  practices  related  to  the  disclosure 

21  among  health  care  providers  of  protected  health  in- 

22  formation  of  an  individual  for  purposes  of  treatment 

23  of  such  individual,  including  an  examination  of  the 

24  best  practices  implemented  by  States  and  by  other 

25  entities,  such  as  health  information  exchanges  and 

26  regional  health  information  organizations,  and  an 
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1  examination  of  the  extent  to  which  such  best  prac- 

2  tices  are  successful  with  respect  to  the  quahty  of  the 

3  resulting  health  care  provided  to  the  individual  and 

4  with  respect  to  the  ability  of  the  health  care  provider 

5  to  manage  such  best  practices;  and 

6  (2)  the  best  practices  with  respect  to  deter- 

7  mining  the  minimum  necessary  set  of  protected 

8  health  information  for  uses  and  disclosures  of  such 

9  information  for  purposes  of  payment  and  the  most 

10  common  health  care  operations,  as  specified  by  the 

11  Secretary,  including  those  health  care  operations 

12  that  could  be  reasonably  and  efficiently  performed 

13  with  either  de-identified  data  (as  defined  in  section 

14  164.514(a)  of  title  45,  Code  of  Federal  Regulations) 

15  or    the    limited    data    set    (as    defined  section 

16  164.514(e)(1)  of  such  title). 

17  SEC.  412.  CLARIFICATION  OF  APPLICATION  OF  WRONGFUL 

18  DISCLOSURES  CRIMINAL  PENALTIES. 

19  Section  1177(a)  of  the  Social  Security  Act  (42  U.S.C. 

20  1320d-6(a))  is  amended  by  adding  at  the  end  the  fol- 

21  lowing  new  sentence:  "For  purposes  of  the  previous  sen- 

22  tence,  a  person  (including  an  employee  or  other  individual 

23  who  is  not  a  covered  entity,  as  defined  in  the  HIPAA  pri- 

24  vacy  regulation  described  in  section  1180(b)(3))  shall  be 

25  considered  to  have  obtained  or  disclosed  indi\idually  iden- 

•HR  6898  IH 


142 

1  tifiable  health  information  in  violation  of  this  part  if  the 

2  information  is  maintained  by  a  covered  entity  (as  so  de- 

3  fined)  and  the  person  knowingly  obtained  or  disclosed  such 

4  information  without  authorization.". 

5  SEC.  413.  IMPROVED  ENFORCEMENT. 


6  (a)  Improved  Civil  Penalties. — 

7  (1)  In  generaIj. — Section  1176  of  the  Social 

8  Security  Act  (42  U.S.C.  1320d-5)  is  amended— 

9  (A)  in  subsection  (b)(1),  by  striking  "the 

10  act  constitutes  an  offense  punishable  under  sec- 

11  tion  1177"  and  inserting  "a  penalty  has  been 

12  imposed  under  section  1177  with  respect  to 

13  such  act";  and 

14  (B)  by  adding  at  the  end  the  following  new 

15  subsection: 

16  "(c)   Noncompliance   Due   to  Willful  Ne- 

17  glect. — 

18  "(1)  In  general. — ^A  violation  of  a  provision 

19  of  this  part  due  to  willful  neglect  is  a  violation  for 

20  which  the  Secretary  is  required  to  impose  a  penalty 

21  under  subsection  (a)(1). 

22  "(2)  Required  im^ESTiGATiON. — For  purposes 

23  of  paragraph  (1),  the  Secretary  shall  formally  inves- 

24  tigate  any  complaint  of  a  violation  of  a  provision  of 

25  this  part  if  a  preliminary  investigation  of  the  facts 
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1  of  the  complaint  indicate  such  a  possible  violation 

2  due  to  willful  neglect. 

3  "(3)  Regulations. — Not  later  than  90  days 

4  after  the  date  of  the  enactment  of  the  Health-e  In- 

5  formation  Technology  Act  of  2008,  the  Secretary 

6  shall  issue  a  notice  of  proposed  rulemaking  in  the 

7  Federal  Register  to  implement  this  subsection.". 

8  (2)  Effective  date. — The  amendments  made 

9  by  paragraph  (1)  shall  apply  to  penalties  imposed  on 

10  or  after  the  date  specified  in  section  433. 

11  (b)  Distribution  op  Civil  Monetary  Penalties 

12  Collected. — 

13  (1)  In  general. — Subject  to  the  regulation 

14  promulgated  pursuant  to  paragraph  (3),  any  civil 

15  monetary  penalty  collected  with  respect  to  an  offense 

16  punishable  under  this  title  or  section  1176  of  the 

17  Social  Security  Act  (42  U.S.C.  1320d-5)  shall  be 

18  transferred  to  the  Office  of  Civil  Rights  of  the  De- 

19  partment  of  Health  and  Human  Services  to  be  used 

20  for  purposes  of  enforcing  the  provisions  of  this  title 

21  and  subparts  C  and  E  of  title  45,  Code  of  Federal 

22  Regulations. 

23  (2)  GAO  REPORT. — Not  later  than  18  months 

24  after  the  date  of  the  enactment  of  this  Act,  the 

25  Comptroller  General  shall  submit  to  the  Secretary  a 
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1  report  including  recommendations  for  a  methodology 

2  under  which  an  individual  who  is  harmed  by  an  act 

3  that  constitutes  an  offense  punishable  under  this 

4  title  or  section  1176  of  the  Social  Security  Act  may 

5  receive  a  percentage  of  any  civil  monetary  penalty 

6  collected  with  respect  to  such  offense  under  this  title 

7  or  such  section. 

8  (3)  Establishment  of  methodology  to 

9  distribute  percentage  of  cmps  collected  to 

10  HARMED  INDIVIDUALS. — Not  later  3  years  after  the 

11  date  of  the  enactment  of  this  Act,  the  Secretary 

12  shall  establish  by  regulation  and  based  on  the  rec- 

13  ommendations  submitted  under  paragraph  (2),  a 

14  methodology  under  which   an   individual  who  is 

15  harmed  by  an  act  that  constitutes  an  offense  punish- 

16  able  under  this  title  or  section  1176  of  the  Social 

17  Security  Act  may  receive  a  percentage  of  any  civil 

18  monetary  penalty  collected  with  respect  to  such  of- 

19  fense  under  this  title  or  such  section. 

20  (4)   Application   of   methodology. — The 

21  methodology  under  paragraph  (3)  shall  be  applied 

22  with  respect  to  civil  monetary  penalties  imposed  on 

23  or  after  the  effective  date  of  the  regulation. 

24  (c)  Tiered  Increase  in  Amount  of  Civil  Mone- 

25  TARY  Penalties. — 
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1  (1)  In  general. — Section  1176(a)(1)  of  the 

2  Social  Security  Act  (42  U.S.C.  1320d-5(a)(l))  is 

3  amended  by  striking  ''who  violates  a  provision  of 

4  this  part  a  penalty  of  not  more  than"  and  all  that 

5  follows  and  inserting  the  following:  "who  violates  a 

6  provision  of  this  part — 

7  "(A)  in  the  case  of  a  violation  of  such  pro- 

8  vision  in  which  it  is  established  to  the  satisfac- 

9  tion  of  the  Secretary  that  the  person  did  not 

10  know  (and  by  exercising  reasonable  diligence 

11  would  not  have  known)  that  such  person  vio- 

12  lated  such  provision,  a  penalty  for  each  such 

13  violation  of  an  amount  that  is  at  least  the 

14  amount  described  in  paragraph  (3) (A)  but  not 

15  to  exceed  the  amount  described  in  paragraph 

16  (3)(D); 

17  "(B)  in  the  case  of  a  violation  of  such  pro- 

18  vision  in  which  it  is  established  to  the  satisfac- 

19  tion  of  the  Secretary  that  the  violation  was  due 

20  to  reasonable  cause  and  not  to  willful  neglect, 

21  a  penalty  for  each  such  violation  of  an  amount 

22  that  is  at  least  the  amount  described  in  para- 

23  graph  (3)(B)  but  not  to  exceed  the  amount  de- 

24  scribed  in  paragraph  (3)(D);  and 
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1  "(C)  in  the  case  of  a  violation  of  such  pro- 

2  Adsion  in  which  it  is  estabhshed  to  the  satisfac- 

3  tion  of  the  Secretary  that  the  violation  was  due 

4  to  willful  neglect — 

5  "(i)  if  the  violation  is  corrected  as  de- 

6  scribed  in  subsection  (b)(3)(A),  a  penalty 

7  in  an  amount  that  is  at  least  the  amount 

8  described  in  paragraph  (3)(C)  but  not  to 

9  exceed  the  amount  described  in  paragraph 

10  (3)(D);  and 

11  "(ii)  if  the  violation  is  not  corrected 

12  as  described  in  such  subsection,  a  penalty 

13  in  an  amount  that  is  at  least  the  amount 

14  described  in  paragraph  (3)(D). 

15  In  determining  the  amount  of  a  penalty  under 

16  this  section  for  a  violation,  the  Secretary  shall 

17  base  such  determination  on  the  nature  and  ex- 

18  tent  of  the  violation  and  the  nature  and  extent 

19  of  the  harm  resulting  from  such  violation.". 

20  (2)  Tiers  of  penalties  described. — Section 

21  1176(a)  of  such  Act  (42  U.S.C.  1320d-5(a))  is  far- 

22  ther  amended  by  adding  at  the  end  the  following 

23  new  paragraph: 
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1  "(3)  Tiers  of  penalties  described. — For 

2  purposes  of  paragraph  (1),  with  respect  to  a  viola- 

3  tion  by  a  person  of  a  provision  of  this  part — 

4  "(A)  the  amount  described  in  this  subpara- 

5  graph  is  $100  for  each  such  violation,  except 

6  that  the  total  amount  imposed  on  the  person 

7  for  all  such  violations  of  an  identical  require- 

8  ment  or  prohibition  during  a  calendar  year  may 

9  not  exceed  $25,000; 

10  "(B)  the  amount  described  in  this  subpara- 

11  graph  is  $1,000  for  each  such  violation,  except 

12  that  the  total  amount  imposed  on  the  person 

13  for  all  such  violations  of  an  identical  require- 

14  ment  or  prohibition  during  a  calendar  year  may 

15  not  exceed  $100,000; 

16  "(C)  the  amount  described  in  this  subpara- 

17  graph  is  $10,000  for  each  such  violation,  except 

18  that  the  total  amount  imposed  on  the  person 

19  for  all  such  violations  of  an  identical  require- 

20  ment  or  prohibition  during  a  calendar  year  may 

21  not  exceed  $250,000;  and 

22  "(D)  the  amount  described  in  this  sub- 

23  paragraph  is  $50,000  for  each  sncli  violation, 

24  except  that  the  total  amount  imposed  on  the 

25  person  for  all  such  xiolatioiis  of  an  identical  re- 


•HR  6898  IH 


148 

1  quirement  or  prohibition  during  a  calendar  year 

2  may  not  exceed  $1,500,000.". 

3  (3)     Conforming     amendments. — Section 

4  1176(b)  of  such  Act  (42  U.S.C.  1320d-5(b))  is 

5  amended — 

6  (A)  by  striking  paragraph  (2)  and  redesig- 

7  nating  paragraphs  (3)  and  (4)  as  paragraphs 

8  (2)  and  (3),  respectively;  and 

9  (B)  in  paragraph  (3) — 

10  (i)  in  subparagraph  (A),  by  striking 

11  "in  subparagraph  (B),  a  penalty  may  not 

12  be  imposed  under  subsection  (a)  if"  and  all 

13  that  follows  through  "the  failure  to  comply 

14  is  corrected"  and  inserting  "in  subpara- 

15  graph  (B)  or  subsection  (a)(1)(C),  a  pen- 

16  alty  may  not  be  imposed  under  subsection 

17  (a)  if  the  failure  to  comply  is  corrected"; 

18  and 

19  (ii)  in  subparagraph  (B),  by  striking 

20  "(A)(ii)"  each  place  it  appears  and  insert- 

21  '  ing  "(A)". 

22  (4)  Effective  date. — The  amendments  made 

23  by  this  subsection  shall  apply  to  violations  occurring 

24  after  the  date  of  the  enactment  of  this  Act. 
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1  (d)  Enforcement  by  State  Attorneys  Gen- 

2  ERAL. — 

3  (1)  CmL  actions. — In  any  case  in  which  the 

4  attorney  general  of  a  State  or  any  State  or  local  law 

5  enforcement  agency  authorized  by  the  State  attorney 

6  general  or  by  State  law  to  prosecute  violations  of 

7  consumer  protection  laws,  has  reason  to  believe  that 

8  an  interest  of  the  residents  of  that  State  has  been 

9  or  is  threatened  or  adversely  affected  by  the  engage- 

10  ment  of  a  person  in  a  practice  that  is  prohibited 

1 1  under  a  provision  of  this  title  or  subparts  C  or  E  of 

12  title  45,  Code  of  Federal  Regulations,  the  State  or 

13  local  law  enforcement  agency  on  behalf  of  the  resi- 

14  dents  of  the  agency's  jurisdiction,  may  bring  a  civil 

15  action  on  behalf  of  the  residents  of  the  State  or  ju- 

16  risdiction  in  a  district  court  of  the  United  States  of 

17  appropriate  jurisdiction  to — 

18  (A)  enjoin  that  act  or  practice; 

19  (B)  enforce  compliance  with  the  provision; 

20  or 

21  (C)  obtain  civil  penalties  in  an  amount  cal- 

22  culated  by  multiplying  the  number  of  violations 

23  by  an  amount  not  greater  than  $11,000. 

24  (2)  Rule  of  construction. — For  purposes  of 

25  bringing  any  civil  action  under  paragraph  (1),  noth- 


HR  6898  IH 


150 

1  ing  in  this  title  regarding  notification  shall  be  con- 

2  stmed  to  prevent  an  attorney  general  of  a  State 

3  from  exercising  the  powers  conferred  on  such  attor- 

4  ney  general  by  the  laws  of  that  State  to — 

5  (A)  conduct  investigations; 

6  (B)  administer  oaths  or  affirmations;  or 

7  (C)  compel  the  attendance  of  witnesses  or 

8  the  production  of  documentary  and  other  evi- 

9  dence. 

10  (3)  Venue ;  service  of  process. — 

11  (A)  Venue. — ^Any  action  brought  under 

12  paragraph  (1)  may  be  brought  in  the  district 

13  court  of  the  United  States  that  meets  applicable 

14  requirements  relating  to  venue  under  section 

15  1391  of  title  28,  United  States  Code. 

16  (B)  Service  of  process. — In  an  action 

17  brought  under  paragraph  (1),  process  may  be 

18  served  in  any  district  in  which  the  defendant — 

19  (i)  is  an  inhabitant;  or 

20  (ii)  may  be  found. 

21  SEC.  414.  AUDITS. 

22  The  Secretary  shall  provide  for  periodic  audits  to  en- 

23  sure  that  entities  that  are  subject  to  the  requirements  of 

24  this  title  and  subparts  C  and  E  of  title  45,  Code  of  Federal 

25  Regulations,  comply  with  such  requirements. 
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1  SEC.  415.  TECHNICAL  AMENDMENT. 

2  Section  1171(5)  of  the  Social  Security  Act  (42  U.S.C. 

3  1320d)  is  amended  by  striking  "or  C"  and  inserting  "C, 

4  orD". 

5  Subtitle  B— Chief  Privacy  Officer 

6  of    ONCHIT;     Standards  and 

7  Guidance  Recommendations  Re- 

8  lated  to  Privacy  and  Security 

9  SEC.  421.  CHIEF  PRIVACY  OFFICER  OF  THE  OFFICE  OF  THE 

10  NATIONAL  COORDINATOR  . 

11  (a)  In  General. — To  assist  the  National  Coordi- 

12  nator  in  carrying  out  all  the  duties  of  the  National  Coordi- 

13  nator  relating  to  the  privacy  and  security  of  health  infor- 

14  mation,  not  later  than  12  months  after  the  date  of  the 

15  enactment  of  this  Act,  the  Secretary  shall  appoint  a  Chief 

16  Privacy  Officer  of  the  Office  of  the  National  Coordinator 

17  established  under  section  3001(a)  of  the  Public  Health 

18  Service  Act,  as  added  by  section  101. 

19  (b)  Consultation. — In  carrying  out  the  duties 

20  under  subsection  (a),  the  Chief  Privacy  Officer  shall  con- 

21  suit  with  the  officials  designated  under  subsection  (c)(1) 

22  and  is  encouraged  to  consult  with  officials  in  other  Federal 

23  agencies  who  have  primary  responsibility  relating  to  the 

24  privacy  and  security  of  individually  identifiable  informa- 

25  tion. 
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1  (c)  Coordination  With  Internal  Privacy  Offi- 

2  CERS. — The  Secretary  shall  ensure  that — 

3  (1)  not  later  than  12  months  after  the  date  of 

4  the  enactment  of  this  Act,  each  agency  specified  by 

5  the  Secretary  with  the  Department  of  Health  and 

6  Human  Services  that  deals  with  health  information 

7  has  an  official  who  is  designated  with  specific  re- 

8  sponsibilities  with  regard  to  the  privacy  and  security 

9  of  such  information;  and 

10  (2)  such  officials  coordinate  their  activities  with 

1 1  the  Chief  Privacy  Officer. 

12  SEC.  422.  ADDITIONAL  STANDARDS  AND  GUIDANCE  REC- 

13  OMMENDATIONS  RELATED  TO  PRIVACY  AND 

14  SECURITY. 

15  (a)  In  General. — In  carrying  out  section  3001(c)(2) 

16  of  the  Public  Health  Service  Act,  as  added  by  section  101, 

17  the  National  Coordinator  shall — 

18  (1)  periodically  recommend  to  the  Secretary 

19  standards  and  guidance  related  to  ensuring  the  pri- 

20  vacy  and  security  of  health  information  for  purposes 

21  of  adoption  under  section  3003(a)  of  such  Act,  as  so 

22  added;  and 

23  (2)  periodically  review  and  revise  as  necessary 

24  health  information  privacy  and  security  standards 

25  and  regulations  implemented  under  this  title  and 
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1  subparts  C  and  E  of  title  45,  Code  of  Federal  Regu- 

2  lations. 

3  (b)  Specific  Recommendations. — For  purposes  of 

4  subsection  (a),  the  National  Coordinator  shall  submit  to 

5  the  Secretary  recommendations  on  at  least  the  follo^\dng: 

6  (1)  Application  of  hipaa  to  entities  that 

7  aren't  coa^red  entities. — Taking  into  account 

8  the  results  of  the  study  conducted  under  section 

9  407,  recommendations — 

10  (A)  on  the  extent  to  which  the  provisions 

11  of  this  title  and  subparts  C  and  E  of  title  45, 

12  Code  of  Federal  Regulations,  should  apply  to 

13  entities  using,  disclosing  or  receiving  health  in- 

14  formation  that  are  not  included  under  this  title 

15  or  such  subparts  as  a  covered  entity  or  business 

16  associate;  and 

17  (B)  that  identify  to  which  entities  that  are 

18  not  so  included  should  such  pro\isions  apply. 

19  (2)  Collection  limitations. — Recommenda- 

20  tions  identifying  under  what  circumstances  and  for 

21  what  purposes  protected  health  information  may  be 

22  collected,  including  model  notices  for  such  j)urposes 

23  as  necessary  and  recommendations  about  wliich  of 

24  such  purposes  should  require  separate,  prior  autlioi'- 
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1  ization   from   the   individual   involved.    Such  rec- 

2  ommendations  shall  provide  that — 

3  (A)  such  collection  will  occur  in  a  trans- 

4  parent  process; 

5  (B)  such  collection  shall  be  in  accordance 

6  with  applicable  Federal,  State,  and  local  laws; 

7  and 

8  (C)  such  collection  may  only  occur  for  the 

9  purposes  specified  by  the  entity  collecting  the 

10  information  and  such  purposes  must  be  so  spee- 

11  ified  at  least  not  later  than  the  time  of  coUec- 

12  tion. 

13  (3)  Disclosure  and  use  limitations. — Rec- 

14  ommendations  identifying  the  circumstances  under 

15  which,  to  whom,  and  for  what  purposes  protected 

16  health  information  may  be  used  or  disclosed,  includ- 

17  ing — 

18  (A)  recommendations  about  what  uses  or 

19  purposes  are  permitted  or  required  (taking  into 

20  account  that  protected  health  information  shall 

21  be  disclosed  in  a  non-identifiable  manner  to  the 

22  maximum  extent  possible); 

23  (B)  recommendations  on  best  practices  on 

24  de-identifying  data; 
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1  (C)  recommendations  for  a  technical  stand- 

2  ard  that  allows  for  the  de-identification  of 

3  health  information; 

4  (D)  recommendations  on  how  to  segregate 

5  sensitive  protected  health  information  with  the 

6  goal  of  minimizing  the  reluctance  of  patients  to 

7  seek  care  (or  disclose  information  about  a  con- 

8  dition)  because  of  privacy  concerns  involving 

9  sensitive   protected  health  information  while 

10  maximizing  patient  safety  and  clinical  utility  of 

11  the  information; 

12  (E)  recommendations  to  define  the  "min- 

13  imum  necessary"  set  of  health  information  for 

14  the  most  common  treatment  and  health  care 

15  operations,  as  specified  by  the  Secretary;  and 

16  (F)  recommendations  for  standardized  no- 

17  tification  describing,  in  terms  that  are  easily 

18  understandable  to  individuals,  permissible  uses 

19  and  disclosures  for  the  most  common  payment 

20  and  health  care  operations  purposes  and  spe- 

21  cific  to  the  most  common  covered  entities. 

22  (4)  Electronic  health  records  and  elec- 

23  tronic  medical  records  secl'lhty  features. — 

24  Recommendations  on  security  featui-es,  such  as  user 

25  authentication,  idoiitit}^  management  tools,  and  data 
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1  scrabbing,  that  electronic  health  records  must  have 

2  in  order  to  receive  certification  under  the  program 

3  under  section  3001(c)(3)  of  the  Public  Health  Serv- 

4  ice  Act,  as  added  by  section  101.  Such  recommenda- 

5  tions  shall  include  at  a  minimum  recommendations 

6  with  respect  to  immutable  audit  trails. 

7  (5)   Data  accuracy. — Recommendations  on 

8  how  to  maximize  the  accuracy  of  health  information 

9  used  or  disclosed. 

10  (6)   Accountability. — Recommendations  on 

11  how  to  best  provide  for  accountability  for  uses  and 

12  disclosures  of  health  information. 

13  (7)     Transparency. — Recommendations  on 

14  how  to  maximize  the  transparency  and  openness  of 

15  health  information  privacy  and  security  policies,  in- 

16  eluding  requiring  that  notices  informing  individuals 

17  of  such  policies  be  written  in  an  understandable  and 

18  simple  manner  and  clearly  and  simply  describe  what 

19  the  privacy  and  security  policies  are  and  how  indi- 

20  viduals  can  access  their  protected  health  information 

21  and  amend  it. 

22  (8)  Enforcement. — Recommendation  on  how 

23  to  improve  and  revise  the  enforcement  of  this  title 

24  and  subparts  C  and  E  of  title  45,  Code  of  Federal 

25  Regulations. 
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1  (9)  Reductions  in  breaches. — Recommenda- 

2  tions  on  how  to  reduce  the  number  and  scope  of 

3  breaches,  taking  into  account  information  received 

4  by  the  Secretary  under  section  3002(e)(3)  of  the 

5  Pubhc  Health  Service  Act. 

6  The  National  Coordinator  shall,  to  the  maximum  extent 

7  practicable,  include  the  recommendations  described  in 

8  paragraphs  (1),  (3)(C),  (3)(D),  and  (4)  in  the  initial  set 

9  of  recommendations  submitted  by  the  Coordinator  under 

10  section  3001(c)(2)(A)  of  the  Pubhc  Health  Service  Act, 

11  as  added  by  section  101. 

12  Subtitle  C — Relationship  to  Other 

13  Laws;    Regulatory  References; 

14  Effective  Date 

15  SEC.  431.  RELATIONSHIP  TO  OTHER  LAWS. 

16  (a)  Application  of  HIPAA  State  Preemption. — 

17  Section  1178  of  the  Social  Security  Act  (42  U.S.C. 

18  1320d-7)  shall  apply  to  a  provision  or  requirement  under 

19  this  title  in  the  same  manner  that  such  section  applies 

20  to  a  provision  or  requirement  under  part  C  of  title  XI  of 

21  such  Act  or  a  standard  or  implementation  specification 

22  adopted  or  estabhshed  under  sections  1172  through  1174 

23  of  such  Act. 

24  (b)  Health  Insurance  Portability  and  Ac- 

25  COUNTABILITY  ACT. — The  standards  governing  the  pi  i- 
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1  vacy  and  security  of  individually  identifiable  health  infor- 

2  mation  promulgated  by  the  Secretary  under  sections 

3  262(a)  and  264  of  the  Health  Insurance  Portability  and 

4  Accountability  Act  of  1996  shall  remain  in  effect  to  the 

5  extent  that  they  are  consistent  with  this  title.  The  Sec- 

6  retary  shall  by  rule  amend  such  Federal  regulations  as  re- 

7  quired  to  make  such  regulations  consistent  with  this  title. 

8  SEC.  432.  REGULATORY  REFERENCES. 

9  Each  reference  in  this  title  to  a  provision  of  the  Code 

10  of  Federal  Regulations  refers  to  such  provision  as  in  effect 

1 1  on  the  date  of  the  enactment  of  this  Act  (or  to  the  most 

12  recent  update  of  such  provision). 

1 3  SEC.  433.  EFFECTIVE  DATE. 

14  The  provisions  of  subtitles  A  and  B  of  this  title  (other 

15  than  sections  401(c),  402,  403,  405(c),  405(d),  406(d), 

16  407,  408,  410,  411,  412,  413(b)(2),  413(b)(3),  413(c), 

17  415,  421,  422,  431,  and  432)  shall  take  effect  on  the  date 

18  that  is  12  months  after  the  date  of  the  enactment  of  this 

19  Act. 

O 
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